ISO 45001 Internal Audit Checklist 2026: 80-Point Template

A useful ISO 45001 internal audit is not a long PDF that nobody reads. It is a focused, clause-by-clause walk-through that surfaces real risk and produces actions your business will actually close. This 2026 template gives you exactly that: 80 audit questions across clauses 4 to 10 of ISO 45001:2018, the evidence to look for, typical gaps to check (drawn from the requirements, not from a survey of audit findings), and a scoring rubric that keeps results comparable across sites.

Use it as a working document for your next internal audit cycle (the safety audit checklist template is a separate download), or as a self-assessment before booking your stage 2 / surveillance audit. It follows the 2018 clause structure. ISO lists a revision as ISO/DIS 45001, planned for publication as ISO 45001:2027, so map any new clauses into the template once the edition is published.

How to use this checklist

• Pace. ISO 45001 sets no audit duration or fixed frequency. It requires internal audits at planned intervals, under an audit programme that takes into account the importance of the processes concerned and the results of previous audits (clause 9.2; ISO 45001:2018 follows ISO's high level structure for management system standards, now called the harmonized structure). For multi-site programmes, this template suggests one audit per site per year, plus a central audit on clauses 4, 5, 9.3 and 10.
• Auditors. Clause 9.2.2 requires auditors to be selected, and audits conducted, so that the audit is objective and impartial; ISO 45001 does not require a lead-auditor course. ISO 19011 (see also the glossary entry on ISO 19011), the guideline for auditing management systems (its fourth edition, ISO 19011:2026, was published in May 2026 and ISO lists the 2018 edition as withdrawn), covers how to evaluate auditor competence. This template suggests a two-person team: one leads, one notes.
• Scoring rubric. This template's own scale, not an ISO one. Per question: 2 = Conforms, 1 = Observation (opportunity for improvement), 0 = Minor NC, –1 = Major NC. Roll up by clause and overall.
• Evidence rule. Every "Conforms" needs at least one piece of objective evidence cited in the audit note — a document, an interview, a system screenshot or a site observation.

---

Clause 4 — Context of the organization (8 questions)

1. Is there a documented context analysis covering internal and external issues, including whether climate change is a relevant issue (per Amendment 1:2024)?
2. Are interested parties identified with their needs and expectations documented?
3. Is the scope of the OH&S management system available as documented information?
4. Does the scope set out physical boundaries (sites, units) and activities, and include the activities within the organization's control or influence that can affect its OH&S performance (clause 4.3; Global ACI-TECH-3-016, G.9.2.1.3)?
5. Are workers and worker representatives identified as a primary interested party?
6. Are PESTLE-style external factors (regulatory, technology, economic) reviewed at planned intervals, for example as a management review input (clause 9.3)?
7. Is the scope aligned with the organization's strategic direction and current operations?
8. Are subcontractors, visitors and remote workers explicitly addressed in the scope?

Evidence to collect: Context register, scope statement, interested-parties register, last review minutes.

Gaps to look for: Context register not kept up to date. Climate change not considered. Scope leaves out contractors' work that is within the organization's control or influence.

---

Clause 5 — Leadership & worker participation (12 questions)

1. Is there a current, signed and dated OH&S policy?
2. Does the policy include commitments to provide safe working conditions, eliminate hazards and reduce risks?
3. Does it commit to consultation and participation of workers?
4. Does it commit to continual improvement and to legal/other compliance?
5. Is the policy communicated, understood and applied within the organization?
6. Are top management's OH&S responsibilities documented (e.g. in role descriptions)?
7. Have OH&S roles, responsibilities and authorities been assigned and communicated at all levels?
8. Is there evidence of top management driving OH&S performance, not just signing the policy?
9. Are workers consulted on hazard identification, risk assessment and corrective actions?
10. Are non-managerial workers consulted on policy, objectives and the audit programme?
11. Is the worker consultation evidence specific (names, dates, decisions) rather than generic?
12. Is there a documented mechanism for workers to raise OH&S concerns without reprisal?

Evidence to collect: Policy, org chart with OH&S accountabilities, consultation minutes, worker interviews.

Gaps to look for: Generic policy with no measurable commitments. Worker consultation evidence missing for risk-assessment work. Results of worker consultation not fed into management review.

---

Clause 6 — Planning (14 questions)

1. Is there a documented hazard identification process covering routine, non-routine and emergency activities?
2. Does it cover physical, chemical, biological, ergonomic and psychosocial hazards?
3. Are human factors (fatigue, error, behaviour) addressed?
4. Is there a current risk assessment for each significant activity?
5. Are risk assessments reviewed after incidents, changes or at defined intervals?
6. Is the hierarchy of controls applied (eliminate → substitute → engineering → admin → PPE)?
7. Is there a legal register listing applicable OH&S legislation?
8. Is the legal register updated when regulations change?
9. Are OH&S objectives SMART, measurable and assigned to owners?
10. Are OH&S objectives consistent with the policy and risk-assessment outputs?
11. Are objectives reviewed for progress at defined intervals?
12. Is there a planning process for changes (organizational, process, technology, regulatory)?
13. Are temporary changes (one-off jobs, trials) included in change planning?
14. Are emergency situations identified and emergency-response plans tested?

Evidence to collect: Risk register, legal register, objectives tracker, change records, emergency drill reports.

Gaps to look for: Risk assessments not reviewed after incidents. Legal register missing recent regulations. Objectives written but never tracked.

---

Clause 7 — Support (10 questions)

1. Are OH&S resources (people, time, budget) documented and provided?
2. Is there a competence matrix linking roles to required training and qualifications?
3. Are training records current and accessible?
4. Are workers aware of the OH&S policy and the risks of their work?
5. Are workers aware of the consequences of not following the OH&S management system?
6. Is internal communication documented (toolbox talks, alerts, briefings)?
7. Is external communication (regulators, neighbours, contractors) handled?
8. Are documented OH&S procedures version-controlled and accessible at the point of use?
9. Are records (training, audits, incidents) retained per defined retention rules?
10. Is documented information protected from unauthorized changes and loss?

Evidence to collect: Training matrix, training records, communication log, document control system, retention policy.

Gaps to look for: Training matrix incomplete for contractors. Procedures available in head office but not on site. No documented retention rules.

---

Clause 8 — Operation (14 questions)

1. Are operational controls established for identified risks?
2. Are work permits used for high-risk work (hot work, confined space, working at height, excavation)?
3. Is the management-of-change process applied before changes go live?
4. Are contractors selected on OH&S criteria, not just commercial (see the contractor prequalification playbook)?
5. Are contractor OH&S performance and incidents monitored?
6. Is there a procurement process that considers OH&S (PPE, plant, chemicals)?
7. Are subcontractors integrated into the OH&S system (induction, RAMS, incident reporting)?
8. Are workplace inspections conducted and findings closed within target dates?
9. Is plant and equipment subject to scheduled inspection and maintenance?
10. Are SDS (Safety Data Sheets) current and accessible for all hazardous substances?
11. Is PPE issue tracked and replacement scheduled?
12. Is emergency-response capability periodically tested and exercised (drills, equipment, training)?
13. Are first-aid resources sufficient and first-aiders trained and current?
14. Is occupational health (audiometry, lung function, etc.) provided where risk requires?

Evidence to collect: Permits issued, change records, contractor evaluations, inspection reports, drill reports, SDS register.

Gaps to look for: Subcontractors not inducted. Permits issued but isolation not verified. Drills run but no learning captured. SDS register missing recent substances.

---

Clause 9 — Performance evaluation (12 questions)

1. Are OH&S KPIs defined (TRIR, LTIFR, near-miss rate, audit closure rate)?
2. Are KPIs reported to top management at defined intervals?
3. Are leading indicators (training completion, inspection rate, close-out time) tracked, not just lagging (see top leading safety indicators)?
4. Is compliance with the legal register evaluated at the frequency the organization has set (clause 9.1.2)?
5. Is the result of the compliance evaluation documented?
6. Is there an internal audit programme covering all clauses over a defined cycle?
7. Are internal auditors competent and independent of the area being audited?
8. Are audit findings documented, assigned and tracked to closure?
9. Is the management review held at planned intervals?
10. Does the management review cover all required inputs (audit results, incidents, KPIs, worker consultation, changes, etc.)?
11. Are management review outputs documented as decisions and actions with owners?
12. Are management review outputs implemented and followed up?

Evidence to collect: KPI dashboard, compliance evaluation, audit programme, audit reports, management review minutes.

Gaps to look for: Only lagging indicators tracked. Compliance evaluation undated. Management review missing worker consultation input. Outputs documented but not actioned.

---

Clause 10 — Improvement (10 questions)

1. Are all incidents (work-related, near-miss, ill-health) reported via a defined process?
2. Are incidents investigated proportionate to potential severity?
3. Is root-cause analysis applied (5-Why, Ishikawa, equivalent; see root cause analysis techniques)?
4. Are corrective actions defined and tracked to closure?
5. Is the effectiveness of corrective actions verified?
6. Are nonconformities raised by audits, observations and worker reports also routed through the same process?
7. Is learning from incidents shared across sites and teams?
8. Is there evidence of continual improvement (year-on-year KPI trend, fewer recurring incidents)?
9. Is the OH&S management system itself reviewed for improvement opportunities?
10. Are improvement opportunities captured outside formal audits (e.g. worker suggestions, supplier feedback)?

Evidence to collect: Incident register, RCA records, CAPA tracker, lessons-learned bulletins, year-on-year KPI trends.

Gaps to look for: RCA is "human error" with no underlying cause identified. CAPAs closed without effectiveness check. No mechanism for cross-site learning.

---

Worked example: writing up one finding

A finding is easier to close when it states the requirement, the evidence and the effect in separate lines. Here is an invented example based on question 19.

Note that the grade is the template's own; a certification body uses ISO/IEC 17021-1 grades and its own judgement.

Sampling and evidence tips

These are working suggestions, not requirements of ISO 45001.

For related guidance, see the glossary entries on non-conformance, CAPA and management review, the internal audit software page, the post on investigating incidents to root cause and the capability map, which shows how consistently audit and corrective-action capabilities are documented across vendor profiles.

Post-audit workflow

The timings below are this template's suggestions. ISO 45001 requires audit results to be reported to relevant managers (clause 9.2.2) but sets no deadlines.

1. Closing meeting. Within 24 hours of fieldwork. Walk top management through findings.
2. Audit report. Within 5 working days. Include scope, methodology, findings by clause, scoring, evidence references.
3. CAPA log. Every minor and major NC gets a corrective action with owner and target date. Major NCs need a containment action first, then a permanent fix.
4. Effectiveness review. 30–60 days after CAPA closure, sample the area again and confirm the issue has not reappeared.
5. Management review input. Roll all audit results into the next management review with year-on-year trends.

Software for running this audit

If you move this checklist into software, ask each vendor to demonstrate, with your own records, ISO 45001 templates aligned to this clause structure, mobile evidence capture, corrective-action workflows and an audit pack for the certification body. See the platforms listed in Compare Audit Platforms and the broader ISO 45001 Software guide.

For SMEs running ISO 45001 alongside ISO 9001 and ISO 14001, see ISO 45001 vs ISO 14001 vs ISO 9001: Building One Integrated QHSE Management System for running the three as one system.

Frequently asked questions

How often should ISO 45001 internal audits run? At planned intervals that you set. ISO 45001 does not fix a frequency, but the audit programme must take into account the importance of the processes concerned and the results of previous audits (clause 9.2.2). This template assumes every clause is covered within the programme cycle; high-risk sites can add themed audits (e.g. permits one quarter, contractors the next) to the full-scope audit.

Who can perform an ISO 45001 internal audit? Anyone competent. Clause 9.2.2 requires auditors to be selected, and audits conducted, so that the audit is objective and impartial; not auditing your own work is a common way to achieve this. ISO 45001 does not require a particular course; ISO 19011 gives guidance on evaluating auditor competence.

What is the difference between a minor and a major nonconformity? The grades come from ISO/IEC 17021-1, the standard certification bodies work to, and this template's scoring rubric uses the same two grades. A major nonconformity affects the capability of the management system to achieve its intended results; a minor one does not. Before granting certification, the certification body must have reviewed, accepted and verified the correction and corrective action for each major nonconformity, and reviewed and accepted your plan for each minor one (European co-operation for Accreditation FAQ on ISO/IEC 17021-1, 3.12, 3.13 and 9.5.2).

Can the same checklist work for ISO 45001 and OHSAS 18001 transition? The migration period for accredited OHSAS 18001 certificates ended on 30 September 2021, after the IAF extended it because of COVID-19. If you still run a system built on OHSAS 18001, use this checklist as a gap analysis against ISO 45001: every question maps to an ISO 45001 clause.

How long do audit records need to be retained? Define a retention rule in your documented information (clause 7.5). ISO 45001 requires retention and disposition of documented information to be controlled, but it does not set retention periods.

Should contractors be audited under our ISO 45001 system? You audit your control of contractors (selection, induction, monitoring). You do not audit the contractor's own management system unless your contract requires it.

What if our internal audit finds something the certification audit missed? That is the system working as intended. Document the NC, close it via CAPA, and have the evidence ready for the next surveillance audit.

Does AI change how internal audits are run in 2026? It does not change what ISO 45001 requires. If a platform offers AI features for audits, ask the vendor to demonstrate them on your own records, and treat them as a productivity aid, not a substitute for auditor judgement.

Sources

• ISO: ISO 45001:2018, Occupational health and safety management systems and ISO 45001:2018/Amd 1:2024, climate action changes
• ISO: ISO/IEC Directives, Part 1, Consolidated ISO Supplement, Annex SL, which defines the harmonized structure for management system standards and links to its text
• ISO: ISO 19011:2026, Guidelines for auditing management systems (edition 4, published May 2026; the 2018 edition is listed as withdrawn)
• ISO: ISO/IEC 17021-1:2015, requirements for bodies providing audit and certification of management systems, and the European co-operation for Accreditation FAQ on its definitions of nonconformity
• Global ACI: TECH-3-016, application of ISO/IEC 17021-1 for OH&S management system certification (scope of the OH&S management system, G.9.2.1.3)
• IAF: FAQ on the extended OHSAS 18001 migration deadline

Updated 4 October 2026: the ISO pages for ISO 45001:2018 (revision pending), Amendment 1:2024 and ISO 19011:2026, the Global ACI TECH-3-016 scope clause, the EA FAQ on nonconformity grades and the IAF migration FAQ were opened again; one question and one gap statement on worker consultation were tightened to what the standard requires, the ISO 19011 edition was updated, and a worked finding example and sampling tips were added.

Corrected 23 September 2026: a sentence that called the platforms on our audit management software page "top picks" was reworded; that page does not rank them.

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the standards cited now link to their official texts.