Skip to main content
    QHSEtech
    All templatesAudits · 6 pages · Updated 21 October 2026

    ISO 45001 Internal Audit Checklist Template

    PDF ExcelFree, no email

    Six-page checklist for one internal audit of an occupational health and safety management system against ISO 45001: 80 questions on clauses 4 to 10, in our own words, each with the clause it maps to, the evidence to look for, five result boxes (conforms, opportunity for improvement, minor nonconformity, major nonconformity, not applicable), an evidence reference and notes. Page 1 holds the audit details (scope, criteria, auditor, auditee, dates) and the result key, page 5 has room for questions you add, and page 6 counts the results by clause, with optional points, lists the findings with their NCR or CAPA reference and closes with the conclusion and sign-off. Written against ISO 45001:2018 with Amendment 1:2024. It holds the questions and answers of an audit; the plan, sample and conclusion in full belong on the internal audit plan and report. No ISO text is reproduced, and a completed checklist is not a certificate.

    What's inside

    Page 1: the edition, the audit and the result key

    1. Edition: version 1.0 of 21 October 2026, written against ISO 45001:2018 with Amendment 1:2024, with a pointer to the glossary entry for the revision status
    2. Audit details: audit reference, organisation and site, audit programme reference, the scope (clauses, sites, processes and shifts covered, and what is excluded), the criteria, the lead auditor and team, whether any auditor audits their own work, the auditee and the people interviewed, and the planned date, opening meeting, fieldwork, closing meeting and report dates
    3. Result key: conforms (C), opportunity for improvement (OFI), minor nonconformity (Mi), major nonconformity (Ma) and not applicable (N/A), when to use each, and the optional points 2, 1, 0 and -1

    Pages 1 to 5: 80 questions in seven clause groups. Every question has the clause it maps to, the evidence to look for, five result boxes, an evidence reference and notes, and each group opens with the gaps to look for

    1. Clause 4, Context of the organization (8 questions)
    2. Clause 5, Leadership and worker participation (12)
    3. Clause 6, Planning (14)
    4. Clause 7, Support (10)
    5. Clause 8, Operation (14)
    6. Clause 9, Performance evaluation (12)
    7. Clause 10, Improvement (10)

    Page 5: questions added for this audit: ten lines numbered from 81, each with clause, question, evidence to look for, result, evidence reference and notes

    Page 6: results, findings and sign-off

    • Results by clause: for each clause, the number of questions, the count of each result and of questions not answered, optional points and the maximum points
    • Findings: seven lines with question number, clause, result, the finding, evidence reference, NCR or CAPA reference, owner and due date, plus one invented example line
    • Report, conclusion and sign-off: who the results were reported to and when, the conclusion and what could not be examined, lead auditor, auditee and reviewer, the next audit of the scope and where the record is kept

    The questions, the clause mapping, the result names and the points are ours, to change.

    What requires or shapes this record

    ISO 45001 deals with internal audit in clause 9.2 (Internal audit). No source opened for this page prescribes an audit checklist, its questions or a scale for grading results. This checklist is one input to an internal audit, not the audit programme. ISO's catalogue, opened on 21 October 2026, lists ISO 45001:2018 as the published edition, with Amendment 1:2024 (climate action changes), and lists the standard as to be revised; the glossary entry on ISO 45001 follows the revision. The joint ISO and IAF communiqué on the climate amendments says they make climate change explicit among the issues considered under clauses 4.1 and 4.2, and IAF treated that as a clarification rather than a new requirement; question 1 asks about it. ISO 19011:2026 is ISO's guideline for auditing management systems. The minor and major grades follow the definitions certification bodies work to under ISO/IEC 17021-1, as the European co-operation for Accreditation quotes them; an internal audit may use its own grades. The standards are paid and their text is not reproduced here: clause numbers and titles only, and the clause mapping of each question is ours. Whether your certification body, customer or law asks for more is for you to check. A completed checklist is not a certificate and does not by itself show conformity. This page is general information, not certification or legal advice.

    • ISO 45001:2018, Occupational health and safety management systems, catalogue page (ISO, opened 21 October 2026)

      ISO's catalogue page lists ISO 45001:2018 as published (edition 1, March 2018), last reviewed and confirmed in 2024, at stage 90.92 (International Standard to be revised), with one amendment, ISO 45001:2018/Amd 1:2024 (climate action changes), and a draft of the next version, ISO/DIS 45001, under development. That is why the checklist is stamped with the edition it is written against and the date it was checked, and why the clause references must be re-checked when a new edition is published; the glossary entry on ISO 45001 follows the revision status. The page shows the edition status only; the standard's text is paid and was not reproduced, and the clause numbers and titles on the form are used for reference only.

    • ISO 45001:2018/Amd 1:2024, Climate action changes, catalogue page (ISO, opened 21 October 2026), and the IAF and ISO joint communiqué on the addition of climate change considerations to management system standards (IAF news item of 23 February 2024, archived site, opened 21 October 2026)

      ISO's page (https://www.iso.org/standard/88428.html) lists the amendment as published in February 2024, one page long and applying to ISO 45001:2018. The IAF news item, on a site IAF says is kept for reference since it ceased operations on 1 January 2026, reports the joint communiqué of 22 February 2024: two statements were added to a number of management system standards so that the effects of climate change are considered. It quotes the communiqué as saying that the intent of clauses 4.1 and 4.2 is unchanged, and IAF's decision treats the change as a clarification, not a new requirement, so no full transition was needed. It expects certified organisations to have decided whether climate change is relevant and certification bodies to check that the decision was made and, where it is relevant, acted on. Question 1 of the checklist asks about that decision, and question 2 covers the interested parties under clause 4.2. The amendment's own text is not reproduced here.

    • ISO 19011:2026, Guidelines for auditing management systems, catalogue page (ISO, edition 4, published May 2026, opened 21 October 2026)

      ISO's page lists the fourth edition, published in May 2026, and lists ISO 19011:2018 as withdrawn. It describes the standard as guidance on the principles of auditing, on managing audit programmes and on conducting management system audits, including auditor competence and evaluation. ISO lists it as guidelines, not requirements. It is cited here as the guide to audit method behind the checklist's scope, criteria, evidence and findings parts; its text is paid and was not read or reproduced for this page.

    • European co-operation for Accreditation, FAQ question 35.10, Definition of nonconformity (ISO/IEC 17021-1:2015, definitions 3.11 to 3.13 and clause 9.5.2; opened 21 October 2026)

      The FAQ discusses how certification bodies grade nonconformities and quotes the definitions of ISO/IEC 17021-1, the standard certification bodies work to. In our words: a nonconformity is a requirement not fulfilled; a major one affects whether the management system can deliver its intended results, and a minor one does not; a note adds that significant doubt about effective process control, or several minor nonconformities on the same requirement or issue, can make a nonconformity major. Before granting certification, a certification body reviews, accepts and verifies the correction and corrective action for each major nonconformity and reviews and accepts the plan for each minor one. The checklist's minor and major results follow those definitions so that internal findings read the same way as a certification audit's. They bind certification bodies, not an internal audit, which may set its own grades.

    Each source checked on 21 October 2026. Not legal advice; check the text in force for your site.

    Field by field

    The checklist records the questions and answers of one internal audit against ISO 45001. Fill in page 1 before the opening meeting, mark each question from what you see, read and are told during the audit, and complete page 6 after the closing meeting. The 80 questions, the clause mapping, the five result names and the optional points are ours: mark a question N/A with its reason when it is outside the scope, add your own on page 5, and keep the wording the same between audits of the same scope so that results can be compared. The plan, sample and conclusion in full belong on the internal audit plan and report, and a finding that needs action goes on to your nonconformance or CAPA record.

    Edition and version
    Why: The questions are mapped to the clause numbers of ISO 45001:2018 with Amendment 1:2024, the edition ISO's catalogue listed on 21 October 2026, and the same page lists the standard as to be revised. The edition and checklist version on page 1 show which edition a past audit used and remind you to re-check the mapping when a new edition is published.
    Common mistake: Using an old printout after a new edition is published, so findings cite clause numbers that have moved.
    Audit scope
    Why: A result only speaks for what was examined. Writing the clauses, sites, processes and shifts covered, and what was left out, tells a reader what a Conforms covers and why a question was marked N/A.
    Common mistake: A scope of "ISO 45001" with no site, process or shift, so nobody can tell what the audit did not see.
    Audit criteria
    Why: The audit is judged against the edition of the standard, your own OH&S procedures and your legal register. Naming each, with its revision, means every finding points to a stated requirement and not to the auditor's own view of good practice.
    Common mistake: Raising a nonconformity against a practice that no criterion requires.
    Does any auditor audit their own work?
    Why: Auditor selection belongs to clause 9.2 (Internal audit), and ISO 19011:2026 covers auditor competence and evaluation. The form's own rule is that nobody audits their own work: the Yes or No box makes an exception visible, and Notes say how it was handled so that a reader can judge the result.
    Common mistake: The person who wrote the procedures audits them, and the checklist does not say so.
    Auditee and people interviewed
    Why: Records the area owner who receives the findings and the roles of the people interviewed, so that evidence from interviews can be traced. Several questions, among them those on consultation, participation and awareness, can only be answered by asking non-managerial workers.
    Common mistake: Interviewing managers only, so questions about worker participation are answered from minutes alone.
    Clause
    Why: Each question carries the ISO 45001 clause number it maps to, so that a finding can be written against a clause; where a question touches two clauses, both are given. The mapping is ours, so check it against your own copy of the standard before you cite it in a finding.
    Common mistake: Citing a clause from memory without reading the requirement it holds.
    Audit question
    Why: Written in our own words and in the order of the guide, so no ISO text is reproduced. A question is a prompt to look for evidence, not the requirement itself: the criterion is in the standard and in your own procedures.
    Common mistake: Reading the question to the auditee and writing down the answer, instead of looking for the evidence.
    Evidence to look for
    Why: Suggests the records, interviews and observations that usually answer the question, as a starting point and not a complete list. ISO 19011:2026 is ISO's guideline on conducting management system audits.
    Common mistake: Marking Conforms because a procedure exists, without checking that the work follows it.
    Result
    Why: Five boxes: conforms, opportunity for improvement, minor nonconformity, major nonconformity and not applicable. The minor and major results follow the definitions certification bodies use under ISO/IEC 17021-1, as the European co-operation for Accreditation quotes them: a major nonconformity affects whether the system can achieve its intended results, a minor one does not, and several minors on the same requirement can point to a systemic failure.
    Common mistake: Grading a requirement that is not addressed at all as minor because the area looks safe.
    Evidence reference
    Why: Each result rests on at least one piece of objective evidence: a record number, a document revision, an interview (by role), a system screen or something seen on site. A reference lets another auditor find it again and shows the auditee what the result rests on.
    Common mistake: Writing "seen" or "OK", so the result cannot be checked.
    Not applicable and not answered
    Why: N/A is for a question outside the scope audited or one that does not apply, such as contractor questions on a site with no contractors, with the reason in Notes. A question left blank counts as not answered, so the totals show how much of the checklist the audit really covered.
    Common mistake: Ticking N/A for a question nobody looked at, so the gap disappears from the totals.
    Questions added for this audit
    Why: Room for questions your own procedures, risks or earlier findings call for, numbered from 81 and added to the count of their clause.
    Common mistake: Adding questions to one audit only, so the next audit of the same scope cannot be compared with it.
    Results by clause
    Why: Counts each result per clause, with a check that the counts add up to the number of questions. The optional points use the guide's scale (2, 1, 0 and -1, with N/A and unanswered questions left out of the maximum); they help compare one audit with the next on the same scope and are not an ISO measure.
    Common mistake: Reporting a points total without the findings behind it: one major nonconformity matters more than any score.
    Findings
    Why: One line for each minor or major nonconformity and each opportunity for improvement: the requirement, what was seen and what is missing, the evidence reference, and the NCR or CAPA reference where the action is tracked. Nonconformities are then handled under clause 10.2 (Incident, nonconformity and corrective action).
    Common mistake: A finding written as an opinion ("training is weak") with no requirement and no evidence.
    Report, conclusion and sign-off
    Why: Reporting audit results is part of clause 9.2 (Internal audit). The form records to whom the results went, managers and also workers or their representatives, and when. The conclusion says whether the system, within the scope, conforms and works, and what could not be examined.
    Common mistake: Signing the checklist without saying what the audit could not examine.

    Worked example

    IllustrativeExtract from an invented internal audit of clause 8 at a small packaging plant (invented site, records and figures)

    Question · clauseResultEvidence referenceNotes
    46 · 8.1.1 Permits for high-risk workMinor nonconformityPermit log for the quarter; hot work permits HW-110 to HW-129 sampled (20)1 of the 20 permits (HW-118) was closed without the fire-watch sign-off that the site's permit procedure asks for; the other 19 were complete. Finding F1, corrective action CAPA-031.
    48 · 8.1.4.2 Contractors selected on OH&S criteriaConformsPrequalification files of the 3 contractors used this quarterEach file was scored against the site's own OH&S questionnaire before the order was placed.
    54 · 8.1.1 Safety data sheetsOpportunity for improvementSDS register rev. 7; walk-round of the paint storeAll 14 substances seen in the store have a sheet on the register, but the register does not record when each sheet was last checked against the supplier's current version. Suggest adding a date column. Finding F2.
    57 · 8.2 First aidConformsFirst aid assessment FA-02; certificates of the 4 first-aidersAll four certificates are in date and the rota covers both shifts.
    58 · 8.1.1 Occupational healthNot applicableRisk register rev. 12The site's own risk assessment flags no task for health surveillance. Re-check when the new press line starts.
    Clause 8 results (14 questions)9 C, 2 OFI, 2 Mi, 0 Ma, 1 N/A, 0 not answeredPoints 20 of a maximum of 269 + 2 + 2 + 0 + 1 + 0 = 14 questions. Points: 9 x 2 + 2 x 1 + 2 x 0 - 0 x 1 = 20. Maximum: (14 - 1 N/A) x 2 = 26. The two minor nonconformities are read first, not the points.

    The site, records and figures are invented to show how the form is filled in and are not benchmarks. The extract shows five of the 14 clause 8 questions. The grades follow the result key printed on the form, and another procedure could grade the same facts differently; the points are the template's optional scale, not an ISO measure.

    When a spreadsheet stops being enough

    A printed checklist or a spreadsheet works for one site and an auditor who keeps the programme in their head. It stops working when the same 80 questions are run at several sites, when results must be compared from one cycle to the next, when each nonconformity must become a corrective action with an owner and a reminder, and when the question set has to be re-mapped to a new edition of the standard at every site at once.

    A software record holds the question set as a versioned template mapped to clauses, takes photos and documents as evidence on a phone, raises a corrective action from a finding, and rolls results up by clause and by site for the management review. Ask how a change of edition is handled: whether past audits keep the clause numbers they were run against while new audits use the new mapping. The list below applies the rule used by the ISO 45001 software guide. Nothing in it shows that a product holds this checklist, so test it with one of your own audits.

    Same rule for every product: tagged “EHS Management”, “Safety Management” or “ISO Management”, with a sourced hazard, risk-assessment, investigation or corrective-action capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 40 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.