The audit report is the document your work is judged by. The auditee uses it to fix problems, and management uses it to make decisions, so a vague report wastes a good audit. This guide is for auditors working to ISO 45001:2018, the international standard for occupational health and safety (OH&S) management systems, and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

What is an ISO 45001 audit report?

It is the formal record of what was audited, what was found and what the auditor concluded.

The report comes near the end of the audit, after the closing meeting. Our guide to how an ISO 45001 audit works from start to finish shows where it sits: the report records the audit scope, criteria, activities, findings and conclusions, and the organization then handles any nonconformities through corrective action. If you are still planning the audit, start with our ISO 45001 audit plan and checklist guide.

What should an ISO 45001 audit report include?

A report should include the audit objectives, scope, criteria, findings with evidence and conclusions, plus who and when.

The list below follows ISO 19011 guidance on audit reports. The exact wording is updated between editions of ISO 19011, so check the current edition when you build your own template.

How do you write an ISO 45001 audit finding?

Write each finding in 3 parts: the requirement, the objective evidence and the gap between them.

Our audit guide makes the same point: where a nonconformity is identified, the auditor records the relevant requirement and the evidence supporting the finding. That keeps the finding factual and easy to verify.

• Requirement: the clause of ISO 45001:2018, the organization’s own procedure or the legal requirement that applies.
• Evidence: what you saw, read or were told, including where and from whom.
• Gap: exactly what does not meet the requirement, with no opinion or blame.

What does a weak finding look like?

A weak finding says “Emergency drills are poor.” It names no requirement, no evidence and no gap. A strong finding says which clause applies, which record you checked, and what the record shows. Use the builder below to practice the format.

How do you record conformities and improvements?

Do not record only the problems. Good practices and conformities show the auditee what is working, and they support your conclusions. If your audit programme uses opportunities for improvement, record them with the same evidence discipline.

A finding that cannot be checked against evidence is an opinion, not an audit finding.

How do you write the conclusions?

State how far the audit criteria were fulfilled, and make sure each conclusion follows from the findings.

Conclusions pull the findings together. They answer the audit objectives: does the OH&S management system conform, and is it effectively implemented? ISO 19011 guidance also says the report should note that an audit is a sampling exercise, so there is a risk that the evidence examined is not representative. Say so plainly. Overstating a conclusion is a bigger risk than limiting it.

How do you structure and issue the report?

Draft it from your notes, agree the facts at the closing meeting, and issue it within the agreed time.

1. Draft the report from your audit notes while the evidence is fresh.
2. Present the findings at the closing meeting, and record any unresolved differences.
3. Check that each finding has its requirement, evidence and gap.
4. Review and approve the report as your audit programme requires.
5. Issue it within the agreed period to the parties named in the audit programme or plan, protecting confidentiality.
6. Follow up the corrective action, as covered in our guide to continual improvement in ISO 45001.

What mistakes weaken an ISO 45001 audit report?

The biggest mistakes are findings without evidence, opinions presented as facts and conclusions that go beyond the sample.

• No evidence trail. A reader cannot tell what you actually saw.
• Vague language. “Poor” and “inadequate” do not say what to fix.
• Blaming people. A finding describes the system, not a person.
• Missing the good news. Reports with only problems lose credibility.
• Late issue. A report delayed past the agreed period slows corrective action.

For the skills behind all of this, see our guide on the skills you need to become an ISO 45001 auditor.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.