9 min read
ISO 45001 Management of Change: How to Audit Clause 8.1.3
How to check that changes to equipment, processes, people and requirements are assessed for new hazards before they go live, and that temporary changes do not become permanent.
3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853) · Licensed by KHDA, Dubai
A workplace can be safe on Monday and unsafe on Tuesday because something changed. A new machine arrived, a shift pattern was altered, a guard was removed for a repair or a supplier swapped a material. Management of change is the part of an occupational health and safety (OH&S) management system that stops these changes from creating new hazards unnoticed. An auditor therefore looks at how changes are spotted, assessed and controlled before they take effect. This guide is for auditors working to ISO 45001:2018 and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.
To audit management of change in ISO 45001, check that the organization has processes for the implementation and control of planned temporary and permanent changes that affect OH&S performance. These include new or changed products, services and processes, workplace locations, work organization, working conditions, equipment and workforce, changes to legal and other requirements, changes in knowledge about hazards and risks, and developments in knowledge and technology. Also check that the consequences of unintended changes are reviewed and that action is taken to reduce harm. Clause 8.1.3 of ISO 45001:2018 sets these requirements.
| Standard audited | ISO 45001:2018, Occupational health and safety management systems |
| Clause | 8.1.3, Management of change |
| Purpose | Stop planned and unplanned changes creating new hazards unnoticed |
| Key tests | Changes spotted, risks assessed before start, temporary changes controlled, unintended changes reviewed |
| Evidence to use | Change requests, risk assessments, approvals, training records and interviews |
| Related course | ISO 45001 Lead Auditor · PR357 · CQI and IRCA |
What does ISO 45001 require for management of change?
It requires processes to implement and control planned temporary and permanent changes that affect OH&S performance.
Clause 8.1.3 of ISO 45001:2018 asks the organization to establish processes for planned temporary and permanent changes that affect OH&S performance, and to review the consequences of unintended changes, taking action to mitigate adverse effects as necessary. The hazards and risks that a change brings are assessed as part of the planning requirements, so the two parts work together. Always check the exact wording in the current standard. Our guide to how an ISO 45001 audit works shows where this check sits in an audit, and our guide to the role of top management in ISO 45001 explains who is accountable.
What counts as a change under clause 8.1.3?
Changes to products, processes, places, people, equipment, requirements and knowledge all count.
| Type of change | Examples |
|---|---|
| New or changed processes and products | A new production line or a changed method |
| Workplace and surroundings | A new location, layout or neighboring activity |
| Work organization and conditions | New shift patterns or staffing levels |
| Equipment | New machines or modified guards |
| Workforce | New starters, agency staff or reduced numbers |
| Legal and other requirements | A new or revised legal limit |
| Knowledge and technology | New information about a hazard or a better control |
The riskiest change is the one nobody recorded as a change.
Want to practice auditing a real process? The course includes editable audit working documents and a case study.
What makes good change control under ISO 45001?
Good change control spots the change, assesses the risks before start, approves it, informs people and checks the result.
The table turns the requirement into audit questions. Use it to follow one change from request to review.
| Step | What the auditor asks |
|---|---|
| Spot the change | How does a change get recorded as a change? |
| Assess hazards and risks | Were new hazards and risks assessed before the change went live? |
| Approve and plan | Who authorized it, and what controls were set? |
| Inform and train | Were workers consulted, told and trained before start? |
| Control temporary changes | Is there an end date, and is it removed or made permanent properly? |
| Review the result | Was the outcome checked, and were unintended effects handled? |
Our guide to auditing the hierarchy of controls shows how the controls for a change should be chosen, and our guide to worker consultation and participation in ISO 45001 explains how workers should be involved.
How do you plan an audit of management of change?
Ask for the change log, the procedure and recent change records, and pick changes to trace.
Request the change procedure, the change register or log, recent change requests with their risk assessments and approvals, and records of temporary changes. Choose changes of different kinds, such as new equipment, a change in work organization and a temporary change. Plan to visit the area affected and to talk to the people who work there. Our ISO 45001 audit plan and checklist guide shows how to build this into your checklist, and our guide to the documents required for an ISO 45001 audit helps you decide what to read first.
What evidence should you collect?
Collect the change log, risk assessments, approvals, training records and what you see on site.
| Check | Records | Interview or observation |
|---|---|---|
| Changes are recorded | Change log and requests | Ask how a change is raised and who decides |
| Risks assessed before start | Risk assessments dated before the change | Compare the assessment date with the start date |
| Approved with controls | Approvals and control measures | Ask who signed it and what controls were added |
| People informed and trained | Training and briefing records | Ask affected workers what they were told |
| Temporary changes controlled | Temporary change register with end dates | Look for temporary fixes still in place |
| Unintended changes reviewed | Incident and review records | Ask what happened when something changed unexpectedly |
Remember that a comment is a lead, and you confirm it with a record or an observation. Our guide to how to interview workers in an ISO 45001 audit shows how to ask the questions.
How do you interview people about management of change?
Ask who raises changes, who assesses them and what affected workers were told.
- Ask the change owner how a change is raised and what must happen before it starts.
- Ask the person who assessed it which hazards were considered and when.
- Trace one change from the request to the check after start.
- Ask workers in the area what changed, what they were told and what training they had.
- Ask for a temporary change and when it ends.
Our guide to auditing contractor management in ISO 45001 covers changes brought by contractors, and our guide to auditing emergency preparedness and response in ISO 45001 shows how changes affect emergency plans.
Not sure whether to start as an internal or lead auditor? Compare the two roles in our guide.
What gaps do auditors commonly find in management of change?
Common gaps are changes made without assessment, forgotten temporary fixes and untrained workers.
- Assessed after the fact. The risk assessment is dated after the change went live.
- Forgotten temporary changes. A temporary fix stays in place for months with no end date.
- Not seen as a change. Staffing, shift or supplier changes are never logged.
- Untrained workers. People find out about a change when they meet it.
- Legal changes missed. New requirements do not trigger a review of controls.
Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding. Our guide to auditing evaluation of compliance in ISO 45001 covers how legal changes are tracked, and our guide to auditing management review in ISO 45001 shows where changes should be reviewed.
Change simulation: choose the best auditor action
For practice only. Read each situation and choose the best response. These scenarios were written by 3FOLD Training and are not real exam questions.
1 scenario answered: 1 of 1 correct
Preloaded example: Situation 1 is already answered. A machine started before its risk assessment should prompt you to ask how the change process works.
Frequently asked questions
What does ISO 45001 clause 8.1.3 require?
Clause 8.1.3 of ISO 45001:2018 requires the organization to establish processes for the implementation and control of planned temporary and permanent changes that affect OH&S performance, and to review the consequences of unintended changes, taking action to mitigate adverse effects as necessary. Always check the exact wording in the current standard.
How do you audit management of change in ISO 45001?
Ask for the change procedure, the change log, recent change requests, risk assessments, approvals and records of temporary changes. Trace several changes from request to review, compare assessment dates with start dates, and speak to affected workers. Confirm what you hear with records and observation.
What counts as a change in ISO 45001?
Changes include new or changed products, services and processes, workplace locations and surroundings, work organization, working conditions, equipment and workforce, as well as changes to legal and other requirements, changes in knowledge about hazards and risks, and developments in knowledge and technology.
Does ISO 45001 cover temporary changes?
Yes. Clause 8.1.3 refers to planned temporary and permanent changes. An auditor checks that temporary changes are authorized, risk assessed, time-limited and either removed or made permanent through the proper process.
What are unintended changes in ISO 45001?
Unintended changes are changes that were not planned, such as a supplier substituting a material or a gradual drift in how a task is done. ISO 45001 asks the organization to review their consequences and take action to mitigate adverse effects as necessary.
What evidence do auditors look for on ISO 45001 change control?
Auditors look for the change procedure, the change register, risk assessments dated before the change, approvals and control measures, training and briefing records, temporary change records and incident or review records. They also interview change owners and affected workers.
Does the ISO 45001 Lead Auditor course teach management of change audits?
According to the 3FOLD Training course page, the ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT) and teaches the audit method, which you can apply to clauses such as management of change. We prepare you for the exam; CQI and IRCA examine and certify.
Where 3FOLD Training fits
3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.
Ready to audit with confidence? Check the next batch and see what the course includes.
UAE mobile and WhatsApp: +971 50 481 9989
India mobile: +91 91762 57536
Chennai: Plot No: 1342, HIG, TNHB Main Road, Sithalapakkam, Chennai 600126
Monday to Friday 9:00 am to 5:00 pm, Saturday 9:00 am to 2:00 pm. See the 3FOLD Training contact page for all details.
Leave a reply