You cannot manage what you do not measure, and in occupational health and safety (OH&S) the numbers decide where effort goes. A site that counts only injuries learns about a problem after someone is hurt. A site that also measures its controls can act earlier. An auditor therefore checks both what is measured and what is done with the results. This guide is for auditors working to ISO 45001:2018 and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

__STRIP1__

What does ISO 45001 require for monitoring and measurement?

It requires processes for monitoring, measurement, analysis and performance evaluation.

Clause 9.1.1 of ISO 45001:2018 asks the organization to decide what needs to be monitored and measured, the methods to use so that results are valid, the criteria for judging OH&S performance, when to monitor and when to analyse and communicate the results. It must evaluate OH&S performance and the effectiveness of the management system, make sure monitoring equipment is calibrated or verified and kept in good order, and retain documented information as evidence. Always check the exact wording in the current standard. Our guide to how an ISO 45001 audit works shows where this check sits in an audit.

What should an organization monitor and measure?

It should monitor legal compliance, activities linked to hazards and risks, progress on objectives and the effectiveness of its controls.

The table below turns the list into audit questions. Use it to check whether the monitoring covers the right things.

A number only helps when someone knows what it should be.

Why does the type of indicator matter to an auditor?

Lagging indicators show harm that has already happened, and leading indicators show whether the controls are working before harm occurs.

Injury rates and lost time are lagging indicators. They are important, but they arrive after the event, and low numbers can reflect luck or under-reporting. Leading indicators include completed inspections, closure of corrective actions, near-miss reports and results of health monitoring. ISO 45001 does not name specific indicators, so an auditor checks that the organization chose measures that fit its risks. A site that measures only lagging results is steering by what already went wrong. Our guide to operational control in ISO 45001 explains the controls these measures should test.

How do you plan an audit of monitoring and measurement?

Ask for the monitoring plan, recent reports and calibration records, and pick a sample of measures to trace.

Request the list of what is monitored, the methods and criteria, the last few reports and the calibration records for the equipment. Choose a measure linked to a high risk, one linked to an objective and one linked to a legal requirement. Plan to meet the person who owns the data and the manager who uses it. Our ISO 45001 audit plan and checklist guide shows how to build this into your checklist, and our guide to the documents required for an ISO 45001 audit helps you decide what to read first.

What evidence should you collect?

Collect the monitoring plan, the measurement records, calibration records and proof that results were analysed and used.

Remember that a comment is a lead, and you confirm it with a record or an observation. Our guide to how to interview workers in an ISO 45001 audit shows how to ask the questions.

How do you interview people about monitoring?

Ask the data owner how a measure is taken and the manager what they do with it.

1. Ask the data owner to show how a measurement is taken and recorded.
2. Ask for the criteria and what result would trigger action.
3. Check the equipment by asking when it was last calibrated or verified.
4. Trace one result from the record to the report and to a decision or action.
5. Ask workers or their representatives whether they are told about monitoring results.

Our guide to worker consultation and participation in ISO 45001 explains why workers should hear about the results, and our guide to auditing management review in ISO 45001 shows where performance information goes next.

What gaps do auditors commonly find in monitoring?

Common gaps are injuries counted alone, no criteria, uncalibrated equipment and results nobody uses.

• Lagging data only. The site counts injuries but does not measure its controls.
• No criteria. Numbers are collected but nobody knows what is acceptable.
• Uncalibrated equipment. Instruments are in use with no calibration or verification record.
• Reports nobody reads. Data goes into a monthly report and nothing follows.
• Objectives not tracked. There is no measure showing progress.

Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding. Our guide to auditing evaluation of compliance in ISO 45001 and our guide to auditing an internal audit programme under ISO 45001 cover the neighboring parts of performance evaluation, and our guide to continual improvement in ISO 45001 shows how results drive improvement.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.