An audit finding only improves safety if something changes afterward. That is why follow-up matters: it is where an auditor checks that the organization fixed the problem, found the cause and made sure it stays fixed. This guide is for auditors working to ISO 45001:2018 and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

What does follow-up after an ISO 45001 audit involve?

It involves reviewing the organization’s response to each nonconformity and verifying that the action was completed and effective.

Follow-up sits at the end of the audit cycle, after you report your findings. ISO 19011 describes audit follow-up as verifying the completion and effectiveness of actions, and says it may be part of the audit or of a later one, depending on the audit objectives and programme. Check the current ISO 19011 edition for the exact wording. Our guide to how an ISO 45001 audit works shows the full cycle, and our guide to writing an ISO 45001 audit report covers the findings that follow-up checks.

What does clause 10.2 expect from the organization?

It expects the organization to react, find the cause, act, check the action worked and keep records.

Clause 10.2 of ISO 45001:2018 covers incidents and nonconformities. In plain terms, the organization has to react and correct the problem, evaluate whether action is needed to remove the cause, review its risk assessments, put the necessary action in place and review whether the corrective action worked. It must also change the OH&S management system if needed and keep documented information on the nonconformity and the actions. Worker participation in the investigation is part of it. Always check the exact wording in the current standard. Our guide to incident investigation in ISO 45001 explains the cause-finding step.

What should a good corrective action response include?

A good response states the correction, the cause, the action, the owner and the date, and says how effectiveness will be checked.

Fixing the problem is not the same as fixing the cause.

How do you tell completion from effectiveness?

Completion shows the action was done, and effectiveness shows it solved the problem.

A signed training sheet proves completion. To test effectiveness, watch the task and ask a few workers what they now do differently. Effectiveness often needs some time to show, so the check may come later, for example at the next audit. Our guide to continual improvement in ISO 45001 shows how these results should feed back into the system.

When can you close a nonconformity?

Close it when the evidence shows the correction was made, the cause was addressed and the action was effective.

1. Read the response. Check it covers correction, cause, action, owner and date.
2. Judge it against the finding. Does the action deal with the cause of this nonconformity?
3. Verify completion. Look at records and the workplace itself.
4. Verify effectiveness. Observe the task and talk to the workers affected.
5. Record the decision. State what you checked and why you closed it, or why you did not.

The auditee chooses the action, and the auditor judges whether the evidence supports closure. Auditors do not design the solution for the organization. How long the organization has to respond, and how closure works in a certification audit, depends on the audit programme and the certification body, so confirm those rules for your audit.

What if the evidence is weak or the action fails?

Ask for more evidence, agree a revised plan or keep the nonconformity open.

• Evidence is thin. Ask for the specific record or arrange to observe the task.
• The cause was not found. Ask the organization to look again with the workers involved.
• The date slips. Ask for the reason, interim controls and a new date, and record them.
• The problem returns. Check whether the earlier cause analysis covered similar situations and whether effectiveness was reviewed.

Worker input helps in all four cases. Our guide to worker consultation and participation in ISO 45001 explains why workers should take part. For the wider skill set, see our guide on the skills you need to become an ISO 45001 auditor.

How do you record follow-up in the audit file?

Record what you checked, what you saw and the decision, with the dates.

For each nonconformity, note the response you received, the evidence you reviewed, who you spoke to, what you observed and your decision on closure. Specific notes make the decision traceable. “Guard fitted and in use on both shifts, checked on the line and confirmed by two operators” is evidence. “Action looks fine” is not. Our ISO 45001 audit plan and checklist guide shows how to build follow-up checks into the next audit.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.