A workplace can be safe on Monday and unsafe on Tuesday because something changed. A new machine arrived, a shift pattern was altered, a guard was removed for a repair or a supplier swapped a material. Management of change is the part of an occupational health and safety (OH&S) management system that stops these changes from creating new hazards unnoticed. An auditor therefore looks at how changes are spotted, assessed and controlled before they take effect. This guide is for auditors working to ISO 45001:2018 and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

Where does management of change sit in ISO 45001?

It requires processes to implement and control planned temporary and permanent changes that affect OH&S performance.

Clause 8.1.3 of ISO 45001:2018 asks the organization to establish processes for planned temporary and permanent changes that affect OH&S performance, and to review the consequences of unintended changes, taking action to mitigate adverse effects as necessary. The hazards and risks that a change brings are assessed as part of the planning requirements, so the two parts work together. Always check the exact wording in the current standard. Our guide to how an ISO 45001 audit works shows where this check sits in an audit, and our guide to the role of top management in ISO 45001 explains who is accountable.

Which kinds of change should an auditor look for?

Changes to products, processes, places, people, equipment, requirements and knowledge all count.

The riskiest change is the one nobody recorded as a change.

What does a sound change process look like step by step?

Good change control spots the change, assesses the risks before start, approves it, informs people and checks the result.

The table turns the requirement into audit questions. Use it to follow one change from request to review.

Our guide to auditing the hierarchy of controls shows how the controls for a change should be chosen, and our guide to worker consultation and participation in ISO 45001 explains how workers should be involved.

How should an auditor prepare for the audit?

Ask for the change log, the procedure and recent change records, and pick changes to trace.

Request the change procedure, the change register or log, recent change requests with their risk assessments and approvals, and records of temporary changes. Choose changes of different kinds, such as new equipment, a change in work organization and a temporary change. Plan to visit the area affected and to talk to the people who work there. Our ISO 45001 audit plan and checklist guide shows how to build this into your checklist, and our guide to the documents required for an ISO 45001 audit helps you decide what to read first.

Which records and observations prove the process works?

Collect the change log, risk assessments, approvals, training records and what you see on site.

Remember that a comment is a lead, and you confirm it with a record or an observation. Our guide to how to interview workers in an ISO 45001 audit shows how to ask the questions.

What should you ask workers, supervisors and change owners?

Ask who raises changes, who assesses them and what affected workers were told.

1. Ask the change owner how a change is raised and what must happen before it starts.
2. Ask the person who assessed it which hazards were considered and when.
3. Trace one change from the request to the check after start.
4. Ask workers in the area what changed, what they were told and what training they had.
5. Ask for a temporary change and when it ends.

Our guide to auditing contractor management in ISO 45001 covers changes brought by contractors, and our guide to auditing emergency preparedness and response in ISO 45001 shows how changes affect emergency plans.

Where do change processes usually break down?

Common gaps are changes made without assessment, forgotten temporary fixes and untrained workers.

• Assessed after the fact. The risk assessment is dated after the change went live.
• Forgotten temporary changes. A temporary fix stays in place for months with no end date.
• Not seen as a change. Staffing, shift or supplier changes are never logged.
• Untrained workers. People find out about a change when they meet it.
• Legal changes missed. New requirements do not trigger a review of controls.

Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding. Our guide to auditing evaluation of compliance in ISO 45001 covers how legal changes are tracked, and our guide to auditing management review in ISO 45001 shows where changes should be reviewed.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.