ISO 45001 Readiness Assessment

Evidence to gather before you rate yourself

A self-rating is only as reliable as the records behind it. Before you answer the questions above, collect one example of each item below and note where it is kept and who owns it. If you cannot produce the example within a few minutes, the honest rating for that question is usually lower than your first instinct.

• Scope and context: the written statement of which sites, activities and workers the management system covers, with the date it was last reviewed and who approved it.
• Policy and responsibilities: the signed policy as workers actually receive it, plus a current list of named roles and what each is accountable for.
• Worker participation: minutes, survey results or consultation records that show workers were asked about hazards and what changed as a result.
• Hazards and risk: the risk assessments for one routine task and one non-routine task, each with its review date and the controls chosen.
• Legal requirements register: the list of obligations that apply to you, with the source of each and the date it was last checked for changes.
• Objectives: each objective with an owner, a measure, a deadline and the latest progress figure.
• Competence: training or qualification records for a sample of roles, including contractors, with expiry dates where they apply.
• Operational control: a recent permit, procedure or inspection record, and a record of how a change to a process or piece of equipment was assessed.
• Emergency arrangements: the plan, the date of the last exercise and the actions that came out of it.
• Evaluation and improvement: the latest internal audit report, the last management review record and one incident or near miss traced to a closed corrective action.

Keep these examples in one folder or register. The same set is useful later when you brief an internal auditor, answer a customer questionnaire or talk to a certification body.

Gaps that tend to appear when records are examined

These are patterns worth looking for, described in general terms. They are not findings about your organisation and they are not a list of the requirements of the standard.

• A document that exists but is not used. A procedure is approved and filed, yet the people doing the work cannot say where to find it or when it last changed.
• Participation that is only top-down. Consultation is recorded as a presentation to workers, without a way for workers to raise a hazard and see the response.
• Risk assessments that never change. The assessment predates a new machine, process or contractor and has no review date after the change.
• Lagging measures only. Performance is reported through incident counts, with no measure of activities that prevent incidents, such as inspections completed or actions closed on time.
• Actions closed without checking they worked. A corrective action is marked done when the task is complete, not when someone has confirmed the problem did not recur.
• Contractors treated as outside the system. Induction, competence and supervision records exist for employees but not for the people who work on site under another employer.
• Internal audits that avoid the difficult areas. The programme covers the same easy areas each cycle, and findings are not linked to management review.
• Management review as a formality. The meeting happens, but the record shows no decisions, owners or follow-up from the previous meeting.

Using the result, and its limits

Start with the three lowest clause groups, but also read the highest ones critically: a clause rated as embedded should be the easiest to support with an example from your folder. Turn every gap into one action with an owner and a date, and store it in the register you already use for corrective actions rather than in a separate document.

The questions are paraphrased summaries of areas that the standard covers. They do not quote the standard, which is a paid publication, and they should not be read as its wording. For the requirements themselves, use a licensed copy from ISO or your national standards body. Whether a particular legal obligation applies to your workplace is a question for your regulator or a qualified adviser; this page does not give legal advice and does not predict an audit or certification result.

A shorter version of the checklist, with 16 yes or no prompts, can be embedded on another site; see the widgets page. If the gaps point to a software need, the ISO 45001 software guide lists what to ask vendors to demonstrate.