An emergency plan on a shelf protects nobody. What matters is whether workers, contractors and visitors know what to do when something goes wrong, and whether the organization has tested its plan and learned from it. Clause 8.2 of ISO 45001:2018 covers this, and an auditor needs to test it, not only read it. This guide is for auditors working to the standard and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

What does ISO 45001 require for emergency preparedness and response?

It requires processes to prepare for and respond to the potential emergencies the organization has identified.

In plain terms, clause 8.2 asks the organization to plan its response, including first aid, train people for it and test the response at suitable intervals. It also asks the organization to evaluate its performance and revise the plan when needed, especially after tests and after real emergencies. The organization must tell workers their duties and pass relevant information to contractors, visitors, emergency services, authorities and, where appropriate, the local community. It must also take into account the needs and capabilities of interested parties and keep documented information on the process and the plans. Always check the exact wording in the current standard. Our guide to how an ISO 45001 audit works shows where this check sits in an audit.

Which emergencies should the plan cover?

The plan should cover the emergencies that the organization’s own hazards and risks make possible.

There is no standard list, because the emergencies depend on the site. The organization identifies them through hazard identification and risk assessment, and the auditor checks that the plan matches. Our guide to risk assessment in ISO 45001 explains that starting point.

An emergency plan is only as good as the last time someone tested it.

How do you plan an audit of emergency preparedness?

Start from the organization’s identified emergencies, choose scenarios to sample and plan to cover every shift and every type of person on site.

Ask for the list of potential emergencies and the plan for each. Then pick a few scenarios, favoring the ones with the highest risk, and plan to visit the areas involved. Include different shifts, and think about contractors and visitors too, since they are on site but may not know the layout. Our ISO 45001 audit plan and checklist guide shows how to build these checks into your checklist, and our guide to the documents required for an ISO 45001 audit helps you decide what to read first.

What evidence should you collect?

Use all three methods: records for what was planned, observation for what exists and interviews for what people know.

Remember that an interview comment is a lead, and you confirm it with a record or an observation. Our guide to how to interview workers in an ISO 45001 audit shows how to ask the questions, and our guide to competence and training in ISO 45001 covers the training records.

How do you test whether the emergency plan works?

Ask people what they would do, check the equipment and routes, and compare what you hear with the plan.

1. Ask a worker what they would do if the alarm sounded right now, and where they would go.
2. Walk the route and check that exits are clear, signs are visible and the assembly point exists.
3. Check the equipment that the plan relies on, such as alarms, first aid kits and spill kits, and their inspection records.
4. Ask about the last drill: who took part, what scenario it used and what went wrong.
5. Compare the answers with the plan and the records, and note any difference.

Where the organization works with outside parties, our guide to how ISO 45001 manages contractors adds useful context, and our guide to worker consultation and participation in ISO 45001 explains why workers should help shape the plan.

What do you look for after drills and real emergencies?

Look for evidence that the organization evaluated what happened and revised the plan where needed.

Clause 8.2 asks the organization to evaluate performance and revise its response after tests and, in particular, after real emergencies. A drill record that says “all OK” tells you little. A useful record shows who took part, how long it took, what problems appeared and what changed afterward. For a real event, look for the investigation and any corrective action. Our guide to incident investigation in ISO 45001 and our guide to verifying corrective action after an ISO 45001 audit show how those links work.

What gaps do auditors commonly find?

Common gaps are plans that do not match the site, drills that skip shifts and information that does not reach outside parties.

• A plan that does not match the site. The layout or hazards changed but the plan did not.
• Drills that skip shifts. Night or weekend workers have never taken part.
• “All OK” drill records. Nothing is recorded about problems or changes.
• Outside parties left out. Contractors and visitors do not know the arrangements.
• Equipment not maintained. Kits, alarms or exits are not checked.

Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding. For the wider skill set, see our guide on the skills you need to become an ISO 45001 auditor.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.