Most workplace harm does not come from the way things have always been done. It comes from the day something changed: a new machine, a new layout, a new contractor or a new shift pattern. Clause 8.1.3 of ISO 45001:2018 asks organizations to control those moments, and an auditor needs to know how to test it. This guide is for auditors working to the standard and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

What does ISO 45001 require for management of change?

It requires processes to implement and control planned temporary and permanent changes that affect OH&S performance.

Clause 8.1.3 sits inside operational planning and control, so it works alongside the controls auditors check on the shop floor. In plain terms, the organization needs a way to spot a change, think through its OH&S effects before it happens and manage it. It also has to review what happens when a change turns out differently from plan, and act to reduce any adverse effects. Always check the exact wording in the current ISO 45001:2018 text. Our guide to operational control in ISO 45001 shows the wider clause, and our guide to how an ISO 45001 audit works shows where this check fits in an audit.

Which changes should an auditor expect to see?

Expect changes to products, services and processes, to legal requirements, to knowledge about hazards and to technology.

The standard lists the kinds of change the process should cover. The table below turns that list into audit prompts.

A change that nobody assessed is a hazard nobody has looked at yet.

How do you plan an audit of management of change?

Ask for the list of recent changes, choose a sample that covers different types and risks, and plan the evidence you will check.

Start with the change log or any equivalent record of what has changed since the last audit. Pick changes of different types, such as one equipment change, one change in work organization and one involving contractors, and favor the ones with the highest OH&S risk. Then write your questions into your checklist. Our ISO 45001 audit plan and checklist guide shows how to do this, and our guide to the documents required for an ISO 45001 audit helps you decide what to read first.

How do you trace a change from request to review?

Follow the change step by step and look for evidence at each stage.

1. The trigger. Find how the change was identified and who approved it.
2. Before the change. Look for hazard identification and an OH&S risk assessment that covers the change.
3. Controls. Check that the controls the assessment calls for were put in place, in line with the hierarchy of controls.
4. People. Check communication, training and competence for the workers affected, and whether workers were consulted.
5. After the change. Look for a review that confirms the change works as planned, and see what happened if it did not.

Each stage gives you a different type of evidence, so use all three methods: documented information for the records, observation for the controls and interviews for communication. Where the change involved outside parties, our guide to how ISO 45001 manages contractors adds useful context.

Who should you interview about management of change?

Interview the person who approved the change, the supervisors who ran it and the workers it affected.

The change owner can describe how the process is meant to work. The workers who live with the change can tell you whether anyone explained it, trained them or asked their view. Compare the two accounts. A gap between them is a lead, and you confirm it with records or observation before you write a finding. Our guide to worker consultation and participation in ISO 45001 explains the consultation requirement that applies here.

How do you audit temporary and unintended changes?

Treat temporary changes like permanent ones, and look for a review of anything that did not go as planned.

Clause 8.1.3 covers planned temporary changes as well as permanent ones. Examples include a closed walkway, a rerouted forklift route or a short-term staffing change. Ask how the organization finds such changes, and what happens to the risk assessment while the change lasts. For unintended changes, ask how the organization learns about them, for example through an incident report or a near miss, and whether it reviewed the consequences and acted. Our guide to incident investigation in ISO 45001 and our guide to continual improvement in ISO 45001 show where that learning should go.

What gaps do auditors commonly find in management of change?

Common gaps are changes that never reach the process, risk assessments that are not updated and workers who are not told.

• No trigger. Small changes, such as a new product or a moved bench, never enter the change process.
• Assessment after the fact. The risk assessment is written once the change is finished.
• Records without people. The paperwork is complete, but the affected workers say they were never told.
• Temporary becomes permanent. A short-term arrangement is never reviewed and stays in place.
• No review. Nobody checks whether the change created new hazards.

Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding. For the wider skill set, see our guide on the skills you need to become an ISO 45001 auditor.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.