The audit process for ISO 45001
An ISO 45001 audit comes in two forms: the internal audit you carry out yourself, and the external certification audit. In the external audit, an auditor from an accredited body checks whether your health and safety management system meets ISO 45001 . You can obtain the official standard from NEN . First comes the internal audit, then the external one. On this page we explain both and show what the auditor checks.
An audit does not only assess documents. It mainly checks whether your safety management system works in practice. The auditor also talks to employees on the shop floor about safety.
The ISO 45001 audit process in brief
| Component | What happens? | Result |
|---|---|---|
| Stage 1 | Documentation review | Go or no-go for stage 2 |
| Stage 2 | Implementation audit on site | Certification recommendation |
| Surveillance | Annual monitoring audit | Certificate maintained |
| Recertification | Full reassessment in year 3 | Certificate renewed |
The internal audit for ISO 45001
Before the external auditor comes, you carry out an internal audit yourself. This is not a formality. Clause 9 of the standard requires it. You check whether your own system meets ISO 45001 and whether it works in practice. Think of it as a dress rehearsal.
The internal audit is mandatory and takes place at least once a year. Over one audit cycle, it covers all the requirements of the standard. It does not have to happen in one session. You can spread it across the year.
Who carries out the internal audit?
The internal auditor must be independent of the work they assess. They may not check their own work. Whoever drafted the hazard identification should therefore not audit that part themselves.
Small companies often do not have enough people for that separation. Two options work well. Have colleagues assess each other’s work, or hire an external internal auditor. Training a qualified employee costs €500 to €1,500 (indication, see costs and timeline) and saves money every year after that.
What do you check during the internal audit?
You go through the requirements of the standard and look for evidence that you meet them. The core questions are: do your documents match practice, and does the system actually work? Work through the internal audit chapter by chapter. For each chapter, ask a few concrete questions and collect the matching evidence.
| Chapter | Example questions | What evidence do you collect? |
|---|---|---|
| 4. Context | Do you know which internal and external factors affect your safety? Is the scope still correct? | Context analysis, scope statement, stakeholder overview |
| 5. Leadership and participation | Can top management show its involvement? Are employees really involved? | Health and safety policy, meeting minutes, consultation records |
| 6. Planning | Is the hazard and risk register complete and up to date? Are objectives measurable? | Risk register, overview of legal requirements, objectives plan |
| 7. Support | Are employees competent? Does communication about safety work? | Training register, competence matrix, communication plan |
| 8. Operation | Do measures follow the hierarchy of controls? Have emergency plans been tested? | Work instructions, exercise reports, agreements with contractors |
| 9. Performance evaluation | Do you measure your performance? Has compliance with the law been checked? | KPI overview, compliance evaluation, previous audit reports |
| 10. Improvement | Are incidents investigated and followed up? | Incident reports, root cause analyses, list of corrective actions |
A more detailed version with a status column to tick off is available in the ISO 45001 checklist. You record your findings in an audit report and report them to management. Resolve the findings you discover before the external audit. If you do not, the external auditor will find them anyway.
Carry out the internal audit yourself or outsource it?
You may carry out the internal audit yourself or buy it in. The choice depends on your size, your internal knowledge and the requirement for independence: the auditor may not assess their own work.
| Do it yourself | Outsource | |
|---|---|---|
| Costs | One-off training of €500 to €1,500, then low | Per audit, often €750 to €2,000 (indication) |
| Knowledge | You build up knowledge of the standard yourself | Direct experience from a specialist |
| Independence | Difficult with few employees | Fully independent |
| Suitable for | Companies with several departments | Small companies or a first audit |
Many small companies outsource the first internal audit and then train an employee of their own. That way you combine learning with independence. The training and audit costs are covered on the costs and timeline page.
The internal audit and the external certification audit test the same requirements. The difference: in the internal audit you look at your own system, while in the external audit an independent auditor visits. A thorough internal audit prevents surprises.
The ISO 45001 audit step by step
Stage 1: documentation review
In stage 1, the auditor checks whether you are ready on paper. They review your documentation, your hazard identification and risk assessment, your policy and objectives, and your overview of legal obligations.
The aim is to establish whether your health and safety management system is developed enough to carry out stage 2. The auditor also checks whether you have carried out the internal audit and the management review.
Stage 1 typically takes half a day to one day for smaller organisations. It can take place on site or partly remotely.
After stage 1, you receive a report with findings. If there are fundamental shortcomings, stage 2 is postponed until you have resolved them. There are often comments, but the conclusion is usually that you can move on to stage 2.
Stage 2: implementation audit
In stage 2, the auditor comes to your site to check whether your system does not only exist on paper but also works in practice.
The auditor speaks to employees at different levels. They ask about their knowledge of the policy, their role in the system and how they deal with safety in their daily work. An operator may be asked what they do in a dangerous situation. A manager may explain how workplace inspections are carried out.
The auditor reviews records such as incident reports, workplace inspection results, training records, toolbox talk reports and management review minutes. They want evidence that you do what you say you do.
The auditor walks around the workplace and observes how work is done. Are safety rules followed? Are instructions present and readable? Is the right PPE worn? Does the situation match what is documented?
The auditor is not looking for perfection. They are looking for a working system that meets the requirements and leads to continual improvement. Small deviations are normal and can be resolved.
Possible outcomes of the ISO 45001 audit
After the audit, you receive a report with findings. There are different types of findings.
Conformities are points where you meet the requirements. They confirm that things are going well.
Observations are areas for improvement that are not a deviation from the standard. The auditor sees opportunities to do something better, but you meet the minimum requirements. You are not obliged to act, but it is sensible to do so.
Minor nonconformities are shortcomings that must be resolved, but that do not fundamentally undermine how the system works. You typically have ninety days to deal with them. The certificate is issued once you provide evidence that the nonconformities have been resolved.
Major nonconformities are serious shortcomings that fundamentally undermine how the system works. With major nonconformities, the certificate cannot be issued until they have been resolved and verified through a follow-up audit.
Most organisations receive a few minor nonconformities at the first audit. That is normal. You resolve them, provide evidence and receive your certificate.
Common findings in the ISO 45001 audit
Some shortcomings come up more often. Knowing about them helps you prevent them.
Worker participation
The most specific requirement of ISO 45001 is worker participation. Auditors look at this closely. If employees cannot explain how they are involved in identifying hazards or setting measures, that is a finding.
Make sure worker participation can be demonstrated. Record who took part in risk assessments, how suggestions are handled and which input was included in policy decisions.
Hazards and risks
The hazard identification is incomplete, or the risk assessment is not transparent. The auditor wants to see that you have systematically considered all relevant hazards, including psychosocial risks and risks from non-routine activities.
A register that only lists the obvious hazards is not enough. You must be able to explain how you arrived at your inventory.
Compliance with legislation
The overview of legal requirements is out of date, or the evaluation of compliance is missing. You must not only know which rules apply, but also check periodically whether you comply with them, and record this.
The Arbowet, the Arbobesluit (Dutch Working Conditions Decree) and sector-specific regulations must be identified. The auditor may ask how you keep track of changes in legislation.
Objectives
Objectives are not measurable, or progress is not monitored. “We want to work more safely” is not a good objective. “We will reduce the number of incidents by 20% within 12 months” is, provided you track progress and can show it.
Incident investigation
Incidents are not investigated, or the corrective measures are not effective. The auditor asks about recent incidents and how they were handled. If you have no evidence of root cause analysis and follow-up, that is a finding.
Internal audit
The internal audit was insufficient, or findings were not followed up. The internal audit must cover all the requirements of the standard, and the auditor may not check their own work. Findings must be resolved.
How do you prepare for an ISO 45001 audit?
Good preparation increases the chance of a smooth audit.
Check your documentation
Go through your documentation. Is everything up to date? Do the version numbers match? Are there no contradictions between what you have written and what you do? Outdated documents that do not match practice are a red flag.
Prepare your employees
Inform employees that the audit is coming and what it involves. They do not need to be afraid, but they must be able to explain what they do and how safety is organised in their work.
Tell them to answer honestly. If they do not know something, it is better to say so than to make something up. Auditors value honesty.
Consider practising with a few employees. What questions might they expect? Do they know where the policy is? Do they know the procedure for reporting dangerous situations?
Check your records
Collect the records the auditor is likely to want to see: incident reports, workplace inspections, training records, toolbox talk reports, audit reports and management review minutes.
Make sure they are complete and accessible. If there are still gaps in your records, this is the moment to fill them.
Walk through your workplace
Look at your workplace through the eyes of an auditor. Are safety instructions present where they should be? Is PPE worn correctly? Are escape routes clear? Are hazardous substances stored correctly? Small things stand out.
Plan the audit days
Make sure the relevant people are available. The auditor wants to speak with top management, with the person responsible for the health and safety system and with employees on the shop floor. If key people are on holiday, you have a problem.
Do not try to hide or conceal anything. Auditors are trained to spot inconsistencies. Honesty about shortcomings and how you are tackling them creates a better impression than trying to hide them.
During the ISO 45001 audit
The audit begins with an opening meeting in which the auditor explains the programme and answers questions. They then get to work according to their audit plan.
Assign someone to accompany the auditor and take notes on findings. This helps with follow-up and prevents misunderstandings.
Answer questions honestly and concisely. If you do not know something, say so and offer to provide the information later. Do not speculate or go off on tangents.
If the auditor records a finding, ask for clarification if you do not understand it. You do not have to agree with it, but you must understand what the problem is and how to resolve it.
The audit ends with a closing meeting in which the auditor presents their findings. This is the moment to ask questions about anything unclear.
After the ISO 45001 audit
After the audit, you receive the formal report. For minor nonconformities, you are given time to resolve them, typically ninety days. You provide evidence of the measures taken, and the auditor assesses whether this is sufficient.
Once all nonconformities have been dealt with, you receive the certificate. It is valid for three years.
The annual ISO 45001 surveillance audit
After certification, the auditor returns every year for a surveillance audit. This is shorter than the initial audit, typically a third to a half of the time. The auditor checks whether you maintain and improve the system.
At the surveillance audit, not the whole system is audited, but a selection of elements. Over the three years, everything must be covered.
If the surveillance audit reveals serious shortcomings, the certificate can be suspended or withdrawn. This is rare if you maintain the system seriously.
The ISO 45001 recertification audit
After three years, a recertification audit follows. This is more extensive than a surveillance audit and comparable to the initial audit. The whole system is reassessed.
If recertification is successful, you receive a new certificate for the next three years.
How do you choose a certification body for ISO 45001?
You choose the certification body that carries out the audit yourself. Always choose a body that is accredited by the Raad voor Accreditatie (RvA, Dutch Accreditation Council) or a comparable body that is part of the International Accreditation Forum (IAF) .
Well-known certification bodies in the Netherlands include Kiwa , TÜV , DNV , DEKRA , Bureau Veritas and LRQA .
Request quotes from several bodies and compare them on price, lead time and experience in your sector. An auditor who understands your industry can add more value.
Next step
Turn your preparation into a task list for the audit. Go back to the step-by-step plan for the complete process, or read the frequently asked questions for answers to practical questions.