An internal audit programme is how an organization checks its own OH&S management system. When it works, problems are found early and fixed. When it does not, audits become a yearly tick-box and weaknesses stay hidden. An external or lead auditor therefore looks at the programme itself, not only at what the audits found. This guide is for auditors working to ISO 45001:2018 and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

What does ISO 45001 require for internal audit?

It requires the organization to conduct internal audits at planned intervals and to run an audit programme.

Clause 9.2.1 of ISO 45001:2018 says the audits provide information on whether the OH&S management system conforms to the organization’s own requirements and to the standard, and whether it is effectively implemented and maintained. Clause 9.2.2 then describes the audit programme and what it must contain. Always check the exact wording in the current standard. Our guide to how an ISO 45001 audit works from start to finish shows the audit process, and our guide to auditing management review in ISO 45001 shows where audit results go next.

What should an internal audit programme contain?

It should contain the frequency, methods, responsibilities, consultation, planning needs and reporting for the audits.

The table below turns the requirements into audit questions. Use it to check the programme, not only the audits.

An audit programme that never changes is not responding to risk.

Why do you audit the audit programme itself?

Because weak internal audits leave real problems unfound and give top management false comfort.

If internal audits only visit easy areas, or the same person audits their own department, the results say little about the system. An auditor does not re-do every internal audit. The task is to judge whether the programme is a sound way to learn about the system. Look for signs of real challenge, such as findings, observations and changes to the plan based on what was learned.

How do you plan an audit of the audit programme?

Ask for the programme, the schedule, recent audit reports and auditor records, and plan to meet the programme owner.

Request the audit programme for the current and last cycle, along with reports, finding logs and auditor competence records. Pick two or three completed audits to examine in depth, choosing at least one in a high-risk area. Plan to interview the person who manages the programme and one of the internal auditors. Our ISO 45001 audit plan and checklist guide shows how to build this into your checklist, and our guide to ISO 45001 audit reports shows what good reporting looks like.

What evidence should you collect?

Collect the plan, completed audit records, auditor competence records, reports and proof of follow-up.

Remember that a comment is a lead, and you confirm it with a record or an observation. Our guide to how to interview workers in an ISO 45001 audit shows how to ask the questions.

How do you interview the programme owner and the internal auditors?

Ask open questions about how the programme was planned and what the audits have changed.

1. Ask the programme owner how the schedule was set and what drove the priorities.
2. Ask for an example of a plan change made because of an incident or an audit finding.
3. Ask an internal auditor how they were selected, trained and kept independent.
4. Trace one finding from the audit report to the action and to evidence that it worked.
5. Ask workers or their representatives what they were told about audit results.

Our guide to competence and training in ISO 45001 explains what auditor competence should look like, and our guide to the skills to become an ISO 45001 auditor lists the abilities an auditor needs.

What gaps do auditors commonly find in audit programmes?

Common gaps are a fixed yearly schedule, auditors checking their own work, no worker feedback and findings left open.

• Calendar, not risk. The same areas are audited in the same order every year.
• Self-audit. People audit the process they manage.
• Untrained auditors. Nobody can show how an internal auditor was prepared.
• No worker feedback. Results reach managers but not the workforce.
• Open findings. Nonconformities stay open past their dates with no explanation.

Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding. Our guide to verifying corrective action after an ISO 45001 audit covers how to follow actions through. For the ISO 14001 side, see our guide to internal audit in ISO 14001:2026.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.