Emergencies test an occupational health and safety (OH&S) management system harder than anything else. A fire, a chemical release, a serious injury or a power failure leaves no time to read a procedure for the first time. An auditor therefore checks more than whether an emergency plan exists. The questions are whether people know it, whether it has been tried and whether it improved after the last test or event. This guide is for auditors working to ISO 45001:2018 and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

What does ISO 45001 require for emergency preparedness and response?

It requires a process to prepare for and respond to potential emergency situations.

Clause 8.2 of ISO 45001:2018 asks the organization to establish, implement and maintain the process needed to prepare for and respond to potential emergencies identified in its risk assessment. The process covers a planned response, including first aid, training for that response, periodic testing and exercising, evaluation and revision of the response, and communication. It also asks for documented information on the process and the plans. Always check the exact wording in the current standard. Our guide to how an ISO 45001 audit works shows where this check sits in an audit, and our guide to the hierarchy of controls explains the controls that prevent emergencies in the first place.

What makes a good emergency preparedness and response process?

A good process matches the emergencies the site could really face, and is practiced and improved.

The table turns the requirements into audit questions. Use it to judge the process for one site or activity.

An emergency plan that has never been tested is only a hope.

Who must be told about the emergency plans and involved in them?

Workers, contractors, visitors, emergency services and other relevant interested parties.

Clause 8.2 asks the organization to communicate information on duties and responsibilities to all workers, and relevant information to contractors, visitors, emergency response services, government authorities and, as appropriate, the local community. It also asks the organization to take into account the needs and capabilities of relevant interested parties and ensure their involvement, as appropriate, in developing the planned response. A visitor who cannot find an exit, or a contractor who was never briefed, is a typical audit finding. Our guide to worker consultation and participation in ISO 45001 explains how workers should be involved.

How do you plan an audit of emergency preparedness and response?

Ask for the risk assessment, the emergency plans and the last test records, and pick scenarios to trace.

Request the list of potential emergencies, the plans, training records, the drill and test calendar and the notes from the latest exercises. Choose emergencies of different kinds, such as a fire, a medical event and a spill or release. Plan to see the equipment, such as extinguishers, alarms, first aid kits and exits, and to talk to the people who would respond. Our ISO 45001 audit plan and checklist guide shows how to build this into your checklist, and our guide to the documents required for an ISO 45001 audit helps you decide what to read first.

What evidence should you collect?

Collect the plans, training and drill records, review notes and what you see on site.

Remember that a comment is a lead, and you confirm it with a record or an observation. Our guide to how to interview workers in an ISO 45001 audit shows how to ask the questions.

How do you interview people about emergency response?

Ask what they would do, then compare their answers with the plan and the drill records.

1. Ask the person in charge which emergencies the site could face and how the plan was built.
2. Ask a first aider or emergency team member what their role is and when they were last trained.
3. Ask for the last drill and what the organization learned from it.
4. Ask workers on different shifts where they would go and who they would tell.
5. Ask a contractor or visitor host how outsiders are briefed.

Our guide to auditing OH&S monitoring in ISO 45001 shows how test results become performance information, and our guide to auditing management review in ISO 45001 shows where emergency results should be reviewed.

What gaps do auditors commonly find in emergency preparedness?

Common gaps are untested plans, untrained people, out-of-date plans and visitors who are not informed.

• Untested plan. The plan exists but has never been exercised.
• Untrained responders. First aiders or fire wardens have left, and nobody replaced them.
• No lessons applied. Drill problems were noted but the plan was not changed.
• Out-of-date information. Contact lists, maps and equipment records have not been checked.
• Others left out. Contractors, visitors and night shifts do not know the arrangements.

Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding. Our guide to auditing evaluation of compliance in ISO 45001 covers the neighboring part of performance evaluation, and our guide to continual improvement in ISO 45001 shows how lessons feed improvement.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.