If you are about to audit an occupational health and safety (OH&S) management system, the plan and the checklist decide how much of the real workplace you see. This guide is for auditors working to ISO 45001:2018, the international standard for OH&S management systems, and for anyone preparing for the CQI and IRCA ISO 45001 Lead Auditor course. It settles what belongs in each document and how to build them.

What is an ISO 45001 audit plan, and how is it different from a checklist?

The audit plan describes what the audit will do and when, and the checklist lists the questions you will ask to do it.

The plan is the document the auditee sees. It tells them the objectives, scope, criteria, people and timing, so they can arrange the right people and areas. The checklist is usually your own working document. It turns each clause in scope into open questions and notes the evidence you expect to sample.

Which standard guides ISO 45001 audit planning?

ISO 45001:2018 sets the requirements you audit against, and ISO 19011:2026 gives the guidance on how to audit.

ISO (the International Organization for Standardization) lists ISO 19011:2026 as the current edition of its guidelines for auditing management systems, published in May 2026. It replaces ISO 19011:2018, which ISO now shows as withdrawn. ISO says the update responds to the growing impact of technology, digitization and virtual environments, and to an increased focus on risk analysis and mitigation.

ISO 45001:2018 itself does not include an audit checklist. It requires organizations to plan, establish and maintain an internal audit programme (clause 9.2), so the checklist is something you build from the standard’s clauses and the organization’s own documented information.

What should an ISO 45001 audit plan include?

An audit plan should state what the audit is for, what it covers, what it is measured against, who does it and how it is scheduled.

• Objectives: why the audit is happening, such as verifying conformity or checking that the OH&S system is effective.
• Scope: the sites, activities, shifts and processes included, including contractor work under the organization’s control.
• Criteria: ISO 45001:2018, the organization’s own OH&S procedures, and applicable legal requirements.
• Team: the audit team leader and members, with any technical experts.
• Schedule: time allocated to each area, including opening and closing meetings and time to interview workers.
• Methods and sampling: how you will gather evidence through interviews, observation and record review, and where you will sample more deeply.
• Reporting: how and when findings will be communicated.

Check the exact contents in the current ISO 19011 edition, since the wording of the guidance is updated between editions.

How do you write an ISO 45001 audit plan step by step?

Write the plan in 6 steps, moving from what you want to learn to how the auditee will support you.

1. Confirm the audit objectives and scope with the audit programme owner.
2. Set the criteria: the clauses of ISO 45001:2018, the organization’s procedures and its legal requirements.
3. Review the OH&S documents and earlier audit results. Our guide to the documents required for an ISO 45001 audit lists the 13 categories to look at.
4. Use risk to decide where to look hardest, and note the higher-risk areas for deeper sampling.
5. Assign the team and build the schedule, including time on the shop floor and with workers.
6. Share the plan with the auditee before the audit and agree any changes.

How do you use risk to focus the plan?

Give more time to the activities that can hurt people most. Look for hazardous processes, past incidents, recent changes, contractor work and areas with weak earlier results. A low-risk office and a chemical store should not get the same audit time.

A good plan tells you where to look; a good checklist tells you what to ask; evidence tells you what is true.

How do you build an ISO 45001 audit checklist?

Build the checklist clause by clause from 4 to 10, using open questions and listing the evidence you expect to sample.

Each row below gives you a starting point. Open questions such as “show me how” and “how do you decide” make people explain their real practice, whereas yes/no questions invite yes/no answers. For the wider audit flow, see our guide on how an ISO 45001 audit works from start to finish.

Should you follow the checklist exactly?

No. Use the checklist as a guide, and follow the evidence. If a worker describes a workaround that is not in the procedure, note it, ask why, and trace it to the clause it affects. Record what you saw, who told you and what document or area it relates to, so that each finding can be traced back to evidence.

What mistakes weaken ISO 45001 audit plans and checklists?

The most common mistakes are treating the checklist as the audit, planning without risk, and asking questions that only need a yes or no.

• Auditing paperwork only. Documents show intent; observation and interviews show what happens. Our guide on the skills you need to become an ISO 45001 auditor covers this.
• Equal time for every area. The plan should weight time by risk.
• Yes/no questions. They produce short answers with little evidence.
• Skipping worker voices. Clause 5 is about consultation and participation, so include time to interview workers, not only managers.
• No trace from finding to evidence. Every finding should point to a clause and to the evidence that supports it.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. If you plan to move toward a formal auditor grade afterward, read the steps to become a certified ISO 45001 Lead Auditor.