Audit Planning

The first stage is audit planning. Before the audit begins, the audit team determines the audit scope, objectives, criteria, locations and activities to be covered.

The auditor also considers the organisation's processes and the areas that need to be examined. A clear audit plan helps ensure that important OHSMS processes are covered within the available audit time.

For organisations preparing for their first audit, understanding the basics of ISO 45001 can be helpful. Our guide on ISO 45001:2018 OHSMS Training for Beginners explains the standard in a simple way.

Reviewing Documents and Information

Before or during the audit, the auditor reviews relevant documented information.

This may include the organisation's OHSMS information, policies, procedures, risk-related information, objectives, records and other evidence relevant to the audit scope.

The auditor uses this information to understand how the management system has been established and to identify areas that need further examination during the audit.

Conducting the Opening Meeting

The audit normally begins with an opening meeting.

During this meeting, the auditor explains the audit objectives, scope and criteria. The audit approach, communication arrangements and other practical details may also be discussed.

The opening meeting provides an opportunity for the audit team and organisation to confirm their understanding of how the audit will be conducted.

Conducting the Audit

After the opening meeting, the auditor begins collecting objective evidence.

This can involve interviewing employees, observing workplace activities, reviewing records and examining how OHSMS processes are implemented.

For example, an auditor may ask employees how hazards are identified, how risks are assessed, how operational controls are implemented or how incidents are handled.

The auditor does not normally rely on a single source of information. Evidence from interviews, observations and documented information can be considered together to determine whether requirements are being met.

Evaluating Audit Findings

As evidence is collected, the auditor evaluates it against the audit criteria.

The auditor may identify areas of conformity as well as findings where requirements have not been adequately fulfilled. Findings should be supported by objective evidence rather than personal opinions.

Where a nonconformity is identified, the auditor records the relevant requirement and the evidence supporting the finding.

This stage is important because audit conclusions should be based on evidence collected during the audit.

Reviewing the Audit Findings

Before the audit is concluded, the audit team reviews the evidence and findings.

This helps ensure that the audit conclusions are consistent with the evidence collected and that the audit objectives have been addressed.

The audit team may also review whether the planned audit activities have been completed and whether any important areas require further clarification.

Conducting the Closing Meeting

The audit ends with a closing meeting.

During the closing meeting, the auditor presents the audit conclusions and discusses the findings with the organisation.

If nonconformities have been identified, they are explained along with the evidence supporting them. The organisation may also be informed about the next steps for addressing the findings.

The closing meeting allows both sides to have a clear understanding of the audit results.

Preparing the Audit Report

After the audit, the audit results are documented in an audit report.

The report generally records information such as the audit scope, audit criteria, audit activities, findings and conclusions.

The report provides a formal record of what was examined and what was identified during the audit.

Corrective Action and Follow-Up

If nonconformities are identified, the organisation needs to address them through appropriate corrective action.

The organisation may need to determine the cause of the problem, implement corrective action and provide evidence showing that the issue has been addressed.

Depending on the type of audit and the applicable certification process, follow-up activities may be required to verify that corrective actions have been effectively implemented.

An audit therefore does not always end when the auditor leaves the organisation. The findings and subsequent corrective actions can form an important part of the overall audit process.