ISO 45001- LEAD
AUDITOR TRAINING
COURSE
By Tanuj Waliya
RINA-REGISTRO ITALIANO NAVALE —
ORIGINALLY FOUNDED IN GENOA, ITALY
SINCE 1861
RINA SRL (FOUNDED -2005) - TRAINING DIVISION
COURSE AGENDA
Module 1:
Course Objective
Background Knowledge on ISO-45001
Define Standard & its requirements
All 10 Clauses of Standard
Module 2:
Main Document to be considered
Terms & Definitions
Types of Audits
Certification Body Audits
Module 3:
Case Studies & Audit Stages
How to Conduct Audit
Audit Findings & Non Confirmities
Audit Report
Module 4:
Summary
Final Exam & Closing
MODULE-1: ISO 45001:2018 MANAGEMENT
SYSTEM REQUIREMENTS
Course Objective
Background Knowledge on ISO-45001
Define Standard & its requirements
All 10 Clauses of Standard
COURSE OBJECTIVE • To provide the knowledge & Skills
Required to perform First, Second & Third
Party Audits of Occupational Health &
safety System against ISO 45001:2018 in
accordance with ISO 19011:2018 & ISO
17021:2015
WHY
SAFETY
ISO
45001:2018
REQUIREMENT
S
Prevent Work related injury
& health at work place
Provide Safe & healthy
Workplace
Continuous improvement
of OH & S System at
workplace
Document ISO45001:2018 Prepared by Project Committee ISO/PC283
ISO 45001:2018 REQUIREMENTS
Aim of OH&S Management System (ISO 45001:2018)
• Prevent work-related injury and ill health
Protect workers physically and mentally.
→
• Provide a safe and healthy workplace
Identify hazards, assess risks, and implement effective controls.
→
• Improve OH&S performance continuously
Not just compliance, but ongoing improvement in safety culture and practices.
→
• Fulfil legal and other requirements
Comply with laws, regulations, and stakeholder expectations.
→
• Enhance worker participation and consultation
Involve employees at every level in safety decisions.
→
• Integrate OH&S into overall business processes
Make safety a part of daily operations, not a separate activity.
→
“The aim of OH&S management system is to save lives, protect health, and build a culture where safety is
everyone’s responsibility
TEST-1
PDCA
CYCLE IN
OH&S (ISO
45001:2018
)
CLAUSES OF ISO
45001:2018
The standard follows the High-Level
Structure (HLS) – 10 clauses in total.
Clauses 1–3 = Informative (not
auditable).
Clauses 4–10 = Requirements
(auditable).
CLAUSES OF ISO 45001:2018
Clause 1: Scope
Clause 2: Normative References
Clause 3: Terms & Definitions
Clause 4: Context of the Organization
•4.1 Understand the organization and its context.
•4.2 Understand needs & expectations of workers and other
interested parties.
•4.3 Define scope of OH&S management system.
•4.4 Establish, implement & continually improve the system.
Clause 5: Leadership & Worker Participation
•5.1 Leadership & commitment (top management
accountability).
•5.2 OH&S policy (documented).
•5.3 Roles, responsibilities, and authorities.
•5.4 Consultation and participation of workers.
CLAUSES OF ISO 45001:2018
Clause 6: Planning
•6.1 Actions to address risks and opportunities.
• Hazard identification.
• Risk & opportunity assessment.
• Compliance obligations.
•6.2 OH&S objectives and planning to achieve them.
Clause 7: Support
•7.1 Resources.
•7.2 Competence.
•7.3 Awareness.
•7.4 Communication (internal & external).
•7.5 Documented information (control of documents &
records).
Clause 8: Operation
•8.1 Operational planning and control.
•8.1.2 Hierarchy of controls (Elimination Substitution
→ →
Engineering Admin PPE).
→ →
•8.2 Emergency preparedness and response.
CLAUSES OF ISO 45001:2018
Clause 9: Performance Evaluation
•9.1 Monitoring, measurement, analysis & evaluation.
•9.1.2 Compliance evaluation.
•9.2 Internal audit.
•9.3 Management review.
Clause 10: Improvement
•10.1 General (continual improvement).
•10.2 Incident, nonconformity, corrective action.
•10.3 Continual improvement of OH&S performance.
CLAUSE-1:SCOPE
•The scope of ISO 45001 is to help organizations, regardless of
their size or sector, to prevent work-related injuries and ill-
health, and to create safe and healthy workplaces through
continuous improvement of their OH&S performance.”
Scope
Continual
Improvement
Legal
Requirement
Achieve
Objective
CLAUSE-2: NORMATIVE REFERENCE
ISO 45001:2018 states: “There are no normative references.”
This means:
•You do not need another external standard to understand or implement ISO 45001.
•The document is self-contained everything required is already included.
→
TEST -2
CLAUSE-3:TERMS & DEFINITION
Purpose of Clause 3
•To ensure clarity and consistency on all terms to prevents misunderstandings in audits, training, and
implementation.
CLAUSE-3:TERMS &
DEFINITION
Worker (3.3)
•Person performing work or work-related activities under the
control of the organization.
•Includes employees, contractors, agency staff, interns, volunteers.
Workplace (3.6)
•Place under the organization’s control where a person needs to be
or go for work purposes.
Hazard (3.19)
•Source or situation with potential to cause injury and ill health.
•Example: chemicals, noise, electricity, stress, slippery floor.
CLAUSE-3:TERMS &
DEFINITION
Risk (3.20)
•Effect of uncertainty combination of likelihood and
→
consequence of an event (injury/ill health).
OH&S Risk (3.21)
•Risk specifically related to the occurrence of work-related injury
or ill health.
OH&S Opportunity (3.22)
•Circumstance that can lead to improvement in OH&S
performance.
•Example: introducing automation to reduce repetitive strain
injuries.
CLAUSE-3:TERMS &
DEFINITION
Incident (3.35)
•Work-related event(s) that could have or did result in injury or ill health.
•Includes near-misses.
Participation (3.38) & Consultation (3.39)
•Participation = workers are involved in decision-making.
•Consultation = workers’ opinions are considered before decisions are
made.
Continual Improvement (3.40)
•Ongoing enhancement (not one-time) of OH&S performance.
TEST-3
CLAUSE 4: CONTEXT OF THE ORGANIZATION
Clause 4 ensures the OH&S management system is designed around the real situation of
the organization.
It has 4 sub-clauses (4.1 to 4.4):
4.1 Understanding the Organization and its Context
4.2 Understanding the Needs and Expectations of Workers
and Other Interested Parties
4.3 Determining the Scope of the OH&S Management
System
4.4 OH&S Management System
4.1 UNDERSTANDING THE ORGANIZATION
AND ITS CONTEXT
•Identify internal and external issues that may impact the OH&S system.
•Examples:
•Internal: culture, policies, resources, technology, working conditions.
•External: legal requirements, social expectations, supply chain, contractors, neighboring communities.
Helps the organization align OH&S with business reality.
Clause 4.1 tells us to step back and look at the bigger picture – what inside and outside factors affect
our workplace safety.
4.2 UNDERSTAND NEEDS & EXPECTATIONS OF
WORKERS AND OTHER INTERESTED PARTIES.
•Determine who is affected by your activities.
•Interested parties = workers, contractors, regulators, customers, visitors,
neighbors, insurance companies.
•Identify their relevant needs and expectations (e.g., safe working
conditions, legal compliance, insurance requirements).
Ensures OH&S system covers all stakeholders, not just employees.
4.3 DETERMINING THE SCOPE OF THE OH&S
MANAGEMENT SYSTEM
•Define boundaries & applicability of the system.
Must consider:
•Internal & external issues (4.1).
•Interested parties’ needs (4.2).
•Activities, products, and services.
Must be documented and available.
Example: “The OH&S management system of ABC Ltd.
applies to all operations at the Gandhinagar plant,
including employees, contractors, and visitors.”
4.4 OH&S MANAGEMENT SYSTEM
•Establish, implement, maintain, and continually improve
an OH&S system in line with ISO 45001 requirements.
•Basically bring everything together into a structured
→
system.
Clause 4 is about understanding your world before building the OH&S system. First, know your internal & external
context, then understand what workers and stakeholders need, define the scope of your system, and finally build the
system around it.”
CLAUSE 5: LEADERSHIP AND WORKER
PARTICIPATION 5.1 Leadership and Commitment
5.2 OH&S Policy
5.3 Organizational Roles, Responsibilities,
and Authorities
5.4 Consultation and Participation of Worker
5.1: LEADERSHIP AND COMMITMENT
Top management must:
• Take overall accountability for OH&S performance.
• Ensure integration of OH&S into business
processes.
• Provide resources (people, technology, budget).
• Promote continual improvement.
• Support a culture of safety.
In simple words: Leaders must walk the talk on safety.
5.2 OH&S POLICY
•The organization must establish, implement, and maintain a
documented OH&S policy that:
•Prevents work-related injury and ill health.
•Provides safe and healthy workplaces.
•Fulfils legal and compliance obligations.
•Commits to worker participation and consultation.
•Is communicated to all workers and available to interested
parties.
5.3 ORGANIZATIONAL ROLES, RESPONSIBILITIES, AND AUTHORITIES
•Responsibilities must be defined, assigned, and communicated.
•Everyone must know their role in safety.
•Top management ensures roles are clear (e.g., Safety Officer, Supervisors,
Workers).
5.4 CONSULTATION AND PARTICIPATION OF
WORKER
Workers must be:
• Consulted before decisions (e.g., policy changes, risk
controls).
• Encouraged to participate actively (report hazards, join
safety committees).
•Applies to all levels and functions.
•Special attention for non-managerial workers (frontline
employees).
• Worker participation is not optional – it’s a requirement.
Clause 5 is about people – leaders must commit, set policies, assign responsibilities, and involve workers in
every step of safety.
CLAUSE 6: PLANNING
•6.1 Actions to address risks and opportunities.
• Hazard identification.
• Risk & opportunity assessment.
• Compliance obligations.
•6.2 OH&S objectives and planning to achieve them
6.1 ACTIONS TO ADDRESS RISKS AND OPPORTUNITIES.
The organization must plan actions to address:
•OH&S risks & opportunities
•Legal and other requirements
•Risks and opportunities related to the OH&S management
system itself
It has four sub-sections:
6.1 ACTIONS TO ADDRESS RISKS AND OPPORTUNITIES.
6.1.1 General
•Identify what needs to be considered when planning the system.
•Include hazards, legal obligations, and potential OH&S impacts.
6.1.2 Hazard Identification and Assessment of Risks and Opportunities
•Hazard identification must be proactive & ongoing.
Consider:
• Routine & non-routine activities.
• Human behavior (fatigue, stress, ergonomics).
• Emergency situations.
• People (workers, contractors, visitors, neighbors).
• Changes in organization, technology, legislation.
•Assess risks (likelihood + consequence).
•Identify opportunities (e.g., automation, wellness programs, new PPE).
6.1 ACTIONS TO ADDRESS RISKS AND
OPPORTUNITIES.
•6.1.3 Determination of Legal and Other Requirements
•Identify applicable laws, regulations, and contractual requirements.
•Keep them up to date.
•Integrate them into operations.
•6.1.4 Planning Action
•Decide how to address risks, opportunities, and compliance obligations.
•Integrate these into the OH&S management system.
6.2 OH&S Objectives and Planning to Achieve Them
Set OH&S objectives at relevant levels and functions.
Objectives must be:
•Consistent with OH&S policy.
•Measurable (SMART).
•Monitored and communicated.
•Updated as necessary.
•When planning to achieve objectives, define:
•What will be done.
•Resources required.
•Who will be responsible.
•Timelines.
•How results will be evaluated.
Clause 6 is about planning ahead: find hazards, assess risks, spot opportunities, follow laws, and set clear
objectives with action plans
PLANNING FLOW
Hazard
Identification
Risk Assessment &
opportunities
Legal & Other
Requirements
OH&S Objectives Action Plan
TEST T-4
CLAUSE 7: SUPPORT
•7.1 Resources
•7.2 Competence
•7.3 Awareness
•7.4 Communication
•7.5 Documentation
7.1 RESOURCE
The organization must determine and provide necessary resources
(financial, human, technological, infrastructure) to establish, implement,
maintain, and continually improve the OH&S system.
Example: Providing budget for PPE, hiring a safety officer, allocating funds
for training.
7.2 COMPETENCE
Workers must be competent (have the right education, training, & experience).
Organization must:
•Determine required competence. (Skill /Competence mapping)
•Provide training or take other actions.
•Evaluate effectiveness.
•Retain documented evidence (training records, certifications).
Example: Forklift drivers must be trained and licensed.
7.3 AWARENESS
Workers must be aware of:
•OH&S policy.
•Their contribution to the OH&S system.
•Implications of not following OH&S requirements.
•Hazards and risks relevant to their job.
Example: Workers knowing that bypassing machine guards can
cause severe injury.
7.4 COMMUNICATION
Organization must establish processes for internal and external
communication.
Must decide:
•What will be communicated.
•When to communicate.
•With whom (workers, contractors, regulators, community).
•How (meetings, posters, toolbox talks, reports).
Example: Reporting accidents to regulators, safety alerts to
workers.
7.5 DOCUMENTATION
Two aspects:
•Creating and updating documents must have proper
→
identification, format, review, and approval.
•Control of documented information documents must be
→
available where needed, protected from loss, unauthorized use,
or damage.
Example: SOPs, risk assessments, safety training records,
policies.
Clause 7 ensures we have the right support system – resources, skilled people, awareness, clear communication,
and proper documents – to run OH&S smoothly.
8.OPERATION
8.1 Operational Planning & Control
8.1.2
Eliminating
Hazards &
Reducing OH&S
Risks
8.1.3
Management of
Change
8.1.4
Procurement
8.1.4.2
Contractors
8.1.4.3 Outsourcing
8.1.4.1
General
8.1.1
General
8. Operation
8.2 Emergency Preparedness & Response
8.1 OPERATIONAL PLANNING AND CONTROL
8.1.1 General
The organization must plan, implement, and control processes
to meet OH&S requirements.
This includes:
• Establishing criteria for safe operations.
• Controlling outsourced processes.
• Maintaining documented information (work
instructions, procedures).
Example: Safe work procedure for handling chemicals.
8.1 OPERATIONAL PLANNING AND CONTROL
8.1.2 Eliminating Hazards and Reducing OH&S Risks
Apply the Hierarchy of Controls (in order):
• Elimination (remove the hazard).
• Substitution (replace with less hazardous).
• Engineering controls (isolate people).
• Administrative controls (training, work-rest schedules).
• PPE (last line of defense).
Example: Replace solvent-based paint with water-based (substitution).
8.1 OPERATIONAL PLANNING AND
CONTROL
•8.1.3 Management of Change: Manage changes to processes,
equipment, workforce, or regulations to ensure no new risks are
introduced.
Example: Assess risks before introducing a new machine.
8.1.4 Procurement
8.1.4.1 General : OH&S requirements must be considered in
purchasing goods/services.
8.1.4.2 Contractors: Ensure contractors work safely and follow
OH&S requirements.
8.1.4.3 Outsourcing: Ensure outsourced processes align with
OH&S standards.
Example: Contractor safety agreements, PPE provided to
suppliers.
8.2 EMERGENCY PREPAREDNESS &
RESPONSE
•Organization must prepare for potential emergencies (fire,
explosion, chemical spills, natural disasters).
•Key requirements:
•Identify potential emergencies.
•Develop and implement response plans.
•Conduct drills and training.
•Evaluate and improve plans.
Example: Fire evacuation drills every 6 months.
Clause 8 is where plans turn into action – safe operations, hazard elimination, controlled changes, safe
procurement/contractors, and readiness for emergencies.”
CLAUSE 9: PERFORMANCE EVALUATION
9.1 Monitoring measurement
Analysis & Evaluation
9.1.2 Evaluation of
Complianc
9.1.1
General
9.Performance Evaluation
9.3 Management Review
9.2 Internal Audit
CLAUSE 9: PERFORMANCE EVALUATION
9.1 Monitoring, Measurement, Analysis and Performance Evaluation
9.1.1 General
Organization must determine:
• What needs to be monitored and measured.
• Methods for monitoring and measurement.
• Criteria for evaluating OH&S performance.
• When results should be analyzed and communicated.
9.1.2 Evaluation of Compliance
Organization must evaluate compliance with:
• Legal requirements.
• Other OH&S obligations (industry standards, client requirements).
•Keep records of evaluations and corrective actions if non-compliance found
Example: Measuring accident frequency rate, noise levels, air quality, PPE
compliance, and legal compliance audits.
CLAUSE 9: PERFORMANCE EVALUATION
9.2 Internal Audit
Conduct internal audits at planned intervals to ensure OH&S
system conforms to:
• ISO 45001 standard.
• Organization’s own requirements.
Audit program must consider:
• Importance of processes.
• Results of previous audits.
Auditors must be objective and impartial.
Results must be reported to management.
Example: Quarterly safety audits of different departments.
CLAUSE 9: PERFORMANCE EVALUATION
9.3 Management Review
Top management must review the OH&S management system at planned intervals (usually
annually).
Review must include:
• Status of previous actions.
• Changes in internal/external issues.
• Achievement of OH&S objectives.
• Information on incidents, nonconformities, and corrective actions.
• Opportunities for continual improvement.
Outputs include:
• Decisions on improvement.
• Changes in policy or objectives.
• Allocation of resources.
Example: Annual management review meeting where leadership evaluates incident statistics
and sets new safety targets.
CLAUSE 10: IMPROVEMENT
Improvement
10.1
General
10.2
Incident
Nonconformity
10.3
Continual
Improvement
10.IMPROVEMENT
10.1 General
The organization must continually improve the suitability,
adequacy, and effectiveness of the OH&S management
system.
Means: never settle, always find ways to get safer.
10.2 INCIDENT, NONCONFORMITY AND CORRECTIVE ACTION
If an incident (accident, near miss, unsafe condition) or nonconformity occurs, the
organization must:
• React quickly control & correct it.
→
• Deal with the consequences.
• Investigate to determine the root cause.
• Take corrective actions to prevent recurrence.
• Review effectiveness of the action.
• Update risk assessments, procedures, or system if needed.
• Document everything.
Example: Worker slips immediate first aid + investigation root cause = oil
→ →
leak corrective action = fix machine + update maintenance schedule.
→
10.IMPROVEMENT
10.3 CONTINUAL IMPROVEMENT
10.IMPROVEMENT
Look for opportunities to improve OH&S performance on an ongoing basis.
Sources of improvement can come from:
• Incident investigations.
• Audit findings.
• Worker suggestions.
• New technology.
• Management reviews.
Example: Installing noise-reducing enclosures after workers reported
hearing difficulties, even though legal limits weren’t exceeded
Clause 10 is about learning from mistakes and successes – fixing problems, preventing recurrence, and
continually improving safety performance.
TEST : T-5
MODULE 2: ACCREDITATION ,
CERTIFICATION & TYPES OF AUDIT
Main Document to be considered
Terms & Definitions
Types of Audits
Certification Body Audits
MAIN DOCUMENT TO BE CONSIDERED
ISO/IEC 17021-1:2015- Conformity Assessment–
Requirements for bodies providing audit & certification on management systems
Part 1: Requirements
ISO19011:2018-Guidelines for auditing management systems
ISO 45001:2018- Occupational health & safety management system
Requirements with Guidance for use
TERMS AND DEFINITIONS
•Audit: Systematic, independent, and documented process for obtaining evidence and evaluating it objectively.
•Auditor: Person with competence to conduct audits.
•Audit program: Set of one or more audits planned for a specific period.
•Audit Criteria are the set of policies, procedures, or requirements against which the audit evidence is compared to
determine conformity.
•Audit evidence is the recorded information, statements of fact, or observations collected by the auditor to determine
whether the audit criteria are being met.
•Audit finding is the result of the evaluation of audit evidence against audit criteria.
•Audit conclusion is the overall outcome of the audit, derived from the audit findings and the evaluation of the audit
objectives.
• Audit client: is the person or organization that requests the audit.
• Auditee: is the person or organization being audited.
• Audit Team: Audit team is a group of one or more auditors, led by a team leader, who collectively conduct an
audit.
• Technical Expert : A technical expert is a person who provides specific knowledge or expertise to the audit team
regarding technical, operational, or specialized areas.
• Observer : An observer is a person who attends an audit to gain experience or for other purposes but does not
participate in audit activities such as collecting evidence, evaluating conformity, or making audit findings.
• Guide: A guide is a person designated by the auditee to assist the audit team
• Audit Plan: An audit plan is a documented description of the scope, objectives, and schedule of an audit.
Audit Scope:Audit scope is the extent and boundaries of an audit, specifying what is included and excluded in
terms of: Processes or activities, Departments or functions,Locations or sites,Time period
DIFFERENT TYPE OF AUDITS
First Party audit: Internal Audit
Second Party Audit: External provider Audit
Other external interested party audit
Third party Audits: Certification and / or accreditation audit
Statuary Regulatory & Similar audit
Combined Audits : Carried out together at a single auditee on two or more management
systems
Joint Audits: Audit Carried out at a single auditee by two or more auditing organization
CERTIFICATION BODY AUDITS
Certification
Surveillance ( Planned or Unplanned
Recertification
Special Audit
Transfer/suspension
TEST 6
INITIAL & CERTIFICATION AUDIT
Divided into Stage 1 and Stage 2:
•Stage 1 Audit: Review of client’s management system
documentation, readiness for certification, site-specific
conditions, and preparedness.
•Stage 2 Audit: On-site evaluation of implementation,
effectiveness, and compliance with the standard.
SURVEILLANCE ACTIVITIES
•Conducted at least once a year to ensure ongoing
compliance.
•Includes on-site audits, document reviews, interviews, or
off-site reviews.
Recertification
•Full re-assessment audit before the certificate expires (typically every 3
years).
•Must consider performance over the certification cycle, complaints,
changes in system/operations.
SPECIAL AUDIT
•Conducted when:
•Significant changes occur (legal, organizational, scope).
•Complaints or concerns about nonconformity arise.
•May be short-notice audits.
TRANSFER/SUSPENSION
•Suspension may happen due to:
• Failure to maintain compliance.
• Not allowing surveillance or recertification audits.
• Misuse of certification mark.
•Withdrawal if issues are not resolved.
•Reduction of scope if only part of the system is affected.
CERTIFICATION PROCESS - THIRD-PARTY AUDIT -ACCORDING TO ISO/IEC 17021-1:2015 (3
YEARS AUDIT CYCLE)
PRINCIPALS OF AUDITING
Integrity: the foundation of professionalism
• Fair presentation: the obligation to report truthfully and accurately
• Due professional care: the application of diligence and judgement
in auditing
• Confidentiality: security of information
• Independence: the basis for the impartiality of the audit and
objectivity of the
audit conclusions
• Evidence-based approach: the rational method for reaching reliable
and
reproducible audit conclusions in a systematic audit process
• Risk-based approach: an audit approach that considers risks and
opportunities
PDCA OF ISO 45001:2018
P D
C A
MANAGING AN AUDIT PROGRAMME
Establishing audit programme objectives
• Determining and evaluating audit programme risks and opportunities
Establishing the audit programme
• Roles and responsibilities of the individual(s) managing the audit programme
• Competence of individual(s) managing audit programme
Establishing extent of audit programme
• Determining audit programme resources
MANAGING AN AUDIT PROGRAMME
Implementing audit programme
•Defining the objectives, scope and criteria for an individual audit establishing
extent of audit
Selecting and determining audit methods
• Selecting audit team members
• Assigning responsibility for an individual audit to the audit team leader
Managing audit programme results
• Managing and maintaining audit programme records
• Monitoring audit programme
•Reviewing and improving audit programme
AUDIT OBJECTIVES, AUDIT SCOPE AND AUDIT CRITERIA FOR THIRD
PARTY CERTIFICATION AUDIT ACCORDING TO ISO 45001:2015
Audit objectives:-
• Determination of the conformity of the client’s management system, or
parts of it with audit criteria.
• Evaluation of the ability of the management system to ensure the
organization meets applicable statutory, regulatory and contractual
requirements.
• Evaluation of the effectiveness of the management system to ensure the
client organization is continually meeting its specified objectives.
• As applicable, identification of areas for potential improvement of the
management system
CASE STUDY-1
ROLES, RESPONSIBILITIES, COMPETENCE REQUIREMENTS
• LEAD AUDITORS
• AUDITORS
• TECHNICAL EXPERTS
• AUDITEES
LEAD AUDITOR RESPONSIBILITIES
A person qualified and authorised to manage a system Audit.
• Plan the Audit and organise a team to conduct the Audit.
• Manage all aspects of the Audit ‘on site’
• A person qualified and authorised to perform all, or a portion of, an
audit.
• To audit allocated areas/ activities and report findings to the Lead
Auditor.
• Be aware of the needs and expectation of the Auditee.
• Consider local culture and customs.
AUDITOR PERSONAL BEHAVIOUR
The personal attributes an Auditor needs to develop,
being:
• Ethical
• Open-minded
• Diplomatic
• Observant
• Perceptive
• Versatile
• Tenacious
• Decisive
• Self-reliant
• Able to act with fortitude
• Open to improvement
• Culturally sensitive
• Collaborative
AUDITEE’S RESPONSIBILITIES
Co-operate with the Auditor in the planning and
conducting of the Audit.
• Provide access for the Audit team.
• Provides guides.
• Attend the opening and closing meetings.
• Address and implement corrective action.
Guides
Selected by the Auditee management to accompany the Auditor.
• May or may not be authorised to agree and resolve non-compliances
• Will normally assist the Auditor with identifying procedures, activities and staff
ASSIGN RESPONSIBILITIES TO GUIDES & OBSERVERS
Consider asking or allowing to accompany your audit
team:
• guides (appointed by the auditee): roles and
responsibilities - assisting the
auditors, arranging access, ensuring safety and
security
• observers (e.g. regulator or other interested parties) :
they should not interfere
with the audit.
OTHER AUDIT ACTIVITY
The auditors audit the area assigned to them in the audit plan
• Sample the system
• Collect objective evidence of system effectiveness
• Compare findings from checklist with requirements
• Decide compliance or noncompliance
• Audit team daily meeting [or more frequently
• Decide on system effectiveness
• Agree and categorise non-conformities
• Hold a meeting daily with auditee’s representatives, and at the end
of the audit, prior to the closing meeting.
• Prepare summary report with conclusions and indicate
recommendations
CASE STUDY ,CS-2
Responsibilities and Authority of Team
Leader , Team Member, Guide and Observer
INITIAL INFORMATION – OFFERED BY CB TO TEAM
LEADER / OBTAINED BY TEAM LEADER
• Details of site(s) and company
• Details of processes and products
• Number of staff, shift working
• Scope of the management system
• Audit criteria: standard, documents, specific
regulations etc.
AUDIT PLANNING
STAGE 1 AUDIT
- Performing review of documented information
Audit the client's management system documentation;
• Evaluate the client's location and site-specific conditions and to undertake
discussions with the client's personnel to determine the preparedness for
the stage 2 audit;
• Review the allocation of resources for stage 2 audit and agree with the
client on the details of the stage 2 audit;
• Evaluate if the internal audits and management review are being planned
and performed, and that the level of implementation of the management
system substantiates that the client is ready for the stage 2
CASE STUDY CS- 3
PERFORMING REVIEW OF DOCUMENTED
INFORMATION
(DOCUMENT REVIEW)
AUDIT PLAN - PREPARING
The audit team leader prepare an audit plan based
on the documentation provided by the auditee,
considering:
• the appropriate sampling techniques.
• the collective competence of the audit team.
• the risks to the organization created by the audit.
The audit plan should cover:
• audit objectives
• audit scope and processes to be audited
• audit criteria
• locations, dates, time and duration of audit activities
• audit methods to be used
• audit team members, guides and observers
• appropriate resources to critical areas of the audit.
CASE STUDY - CS-4
AUDIT PLAN
STAGE 2 AUDIT
The purpose of the stage 2 audit is to evaluate the implementation, including
effectiveness
• information and evidence about conformity to all requirements of the applicable
management system standard.
• client's management system and performance as regards legal compliance
• operational control of the client's processes;
• internal auditing and management review
• management responsibility for the client's policies;
• performance monitoring, measuring, reporting and reviewing against key
performance objectives and targets (consistent with the expectations in the
applicable management system standard.
BEFORE STAGE 2 AUDIT ACTIVITIES – MADE BY TEAM
LEADER
• Clarifications regarding audit plan
• Details related to auditee organization
• Conclusions related documentation review
EXERCISE -1
Preparing documented information for audit
check lists – Exercise 1
THE OPENING MEETING
• The language to be used during the audit
• Review the plan
• matters relating to confidentiality and information security;
• Provision of guides & Personal Protective Equipment (PPE)
• Advise that the audit findings will be based on a sample taken.
• Explain how findings will be categorized (non-conformities, etc.)
• Check availability of facilities
• Conditions under which the audit may be terminated
• any system for feedback from the auditee on the findings or conclusions of
the audit, including complaints or appeals.
• Agree arrangements for the closing meeting
• Invite questions for clarification.
VERY IMPORTANT!
Punctuality is important! Arrive on time!
• The meeting should be brief and to the point
CASE STUDY -5 OPENING MEETING
PROBLEMS / ISSUES ENCOUNTERED
• Auditors may not always receive full co-operation from the Auditee, it is
therefore important to recognise when such situations are occurring and take
appropriate action.
• Such instances may include:
• Avoid answering questions
• Going missing
• Delaying the Audit
• Constant interruptions, etc.

reference material iso 45001_2018.pptx reference material iso 45001_2018.pptx

  • 1.
    ISO 45001- LEAD AUDITORTRAINING COURSE By Tanuj Waliya
  • 3.
    RINA-REGISTRO ITALIANO NAVALE— ORIGINALLY FOUNDED IN GENOA, ITALY SINCE 1861 RINA SRL (FOUNDED -2005) - TRAINING DIVISION
  • 4.
    COURSE AGENDA Module 1: CourseObjective Background Knowledge on ISO-45001 Define Standard & its requirements All 10 Clauses of Standard Module 2: Main Document to be considered Terms & Definitions Types of Audits Certification Body Audits Module 3: Case Studies & Audit Stages How to Conduct Audit Audit Findings & Non Confirmities Audit Report Module 4: Summary Final Exam & Closing
  • 5.
    MODULE-1: ISO 45001:2018MANAGEMENT SYSTEM REQUIREMENTS Course Objective Background Knowledge on ISO-45001 Define Standard & its requirements All 10 Clauses of Standard
  • 6.
    COURSE OBJECTIVE •To provide the knowledge & Skills Required to perform First, Second & Third Party Audits of Occupational Health & safety System against ISO 45001:2018 in accordance with ISO 19011:2018 & ISO 17021:2015
  • 7.
  • 8.
    ISO 45001:2018 REQUIREMENT S Prevent Work relatedinjury & health at work place Provide Safe & healthy Workplace Continuous improvement of OH & S System at workplace Document ISO45001:2018 Prepared by Project Committee ISO/PC283
  • 9.
    ISO 45001:2018 REQUIREMENTS Aimof OH&S Management System (ISO 45001:2018) • Prevent work-related injury and ill health Protect workers physically and mentally. → • Provide a safe and healthy workplace Identify hazards, assess risks, and implement effective controls. → • Improve OH&S performance continuously Not just compliance, but ongoing improvement in safety culture and practices. → • Fulfil legal and other requirements Comply with laws, regulations, and stakeholder expectations. → • Enhance worker participation and consultation Involve employees at every level in safety decisions. → • Integrate OH&S into overall business processes Make safety a part of daily operations, not a separate activity. → “The aim of OH&S management system is to save lives, protect health, and build a culture where safety is everyone’s responsibility
  • 10.
  • 11.
  • 12.
    CLAUSES OF ISO 45001:2018 Thestandard follows the High-Level Structure (HLS) – 10 clauses in total. Clauses 1–3 = Informative (not auditable). Clauses 4–10 = Requirements (auditable).
  • 13.
    CLAUSES OF ISO45001:2018 Clause 1: Scope Clause 2: Normative References Clause 3: Terms & Definitions Clause 4: Context of the Organization •4.1 Understand the organization and its context. •4.2 Understand needs & expectations of workers and other interested parties. •4.3 Define scope of OH&S management system. •4.4 Establish, implement & continually improve the system. Clause 5: Leadership & Worker Participation •5.1 Leadership & commitment (top management accountability). •5.2 OH&S policy (documented). •5.3 Roles, responsibilities, and authorities. •5.4 Consultation and participation of workers.
  • 14.
    CLAUSES OF ISO45001:2018 Clause 6: Planning •6.1 Actions to address risks and opportunities. • Hazard identification. • Risk & opportunity assessment. • Compliance obligations. •6.2 OH&S objectives and planning to achieve them. Clause 7: Support •7.1 Resources. •7.2 Competence. •7.3 Awareness. •7.4 Communication (internal & external). •7.5 Documented information (control of documents & records). Clause 8: Operation •8.1 Operational planning and control. •8.1.2 Hierarchy of controls (Elimination Substitution → → Engineering Admin PPE). → → •8.2 Emergency preparedness and response.
  • 15.
    CLAUSES OF ISO45001:2018 Clause 9: Performance Evaluation •9.1 Monitoring, measurement, analysis & evaluation. •9.1.2 Compliance evaluation. •9.2 Internal audit. •9.3 Management review. Clause 10: Improvement •10.1 General (continual improvement). •10.2 Incident, nonconformity, corrective action. •10.3 Continual improvement of OH&S performance.
  • 16.
    CLAUSE-1:SCOPE •The scope ofISO 45001 is to help organizations, regardless of their size or sector, to prevent work-related injuries and ill- health, and to create safe and healthy workplaces through continuous improvement of their OH&S performance.” Scope Continual Improvement Legal Requirement Achieve Objective
  • 17.
    CLAUSE-2: NORMATIVE REFERENCE ISO45001:2018 states: “There are no normative references.” This means: •You do not need another external standard to understand or implement ISO 45001. •The document is self-contained everything required is already included. →
  • 18.
  • 19.
    CLAUSE-3:TERMS & DEFINITION Purposeof Clause 3 •To ensure clarity and consistency on all terms to prevents misunderstandings in audits, training, and implementation.
  • 20.
    CLAUSE-3:TERMS & DEFINITION Worker (3.3) •Personperforming work or work-related activities under the control of the organization. •Includes employees, contractors, agency staff, interns, volunteers. Workplace (3.6) •Place under the organization’s control where a person needs to be or go for work purposes. Hazard (3.19) •Source or situation with potential to cause injury and ill health. •Example: chemicals, noise, electricity, stress, slippery floor.
  • 21.
    CLAUSE-3:TERMS & DEFINITION Risk (3.20) •Effectof uncertainty combination of likelihood and → consequence of an event (injury/ill health). OH&S Risk (3.21) •Risk specifically related to the occurrence of work-related injury or ill health. OH&S Opportunity (3.22) •Circumstance that can lead to improvement in OH&S performance. •Example: introducing automation to reduce repetitive strain injuries.
  • 22.
    CLAUSE-3:TERMS & DEFINITION Incident (3.35) •Work-relatedevent(s) that could have or did result in injury or ill health. •Includes near-misses. Participation (3.38) & Consultation (3.39) •Participation = workers are involved in decision-making. •Consultation = workers’ opinions are considered before decisions are made. Continual Improvement (3.40) •Ongoing enhancement (not one-time) of OH&S performance.
  • 23.
  • 24.
    CLAUSE 4: CONTEXTOF THE ORGANIZATION Clause 4 ensures the OH&S management system is designed around the real situation of the organization. It has 4 sub-clauses (4.1 to 4.4): 4.1 Understanding the Organization and its Context 4.2 Understanding the Needs and Expectations of Workers and Other Interested Parties 4.3 Determining the Scope of the OH&S Management System 4.4 OH&S Management System
  • 25.
    4.1 UNDERSTANDING THEORGANIZATION AND ITS CONTEXT •Identify internal and external issues that may impact the OH&S system. •Examples: •Internal: culture, policies, resources, technology, working conditions. •External: legal requirements, social expectations, supply chain, contractors, neighboring communities. Helps the organization align OH&S with business reality. Clause 4.1 tells us to step back and look at the bigger picture – what inside and outside factors affect our workplace safety.
  • 26.
    4.2 UNDERSTAND NEEDS& EXPECTATIONS OF WORKERS AND OTHER INTERESTED PARTIES. •Determine who is affected by your activities. •Interested parties = workers, contractors, regulators, customers, visitors, neighbors, insurance companies. •Identify their relevant needs and expectations (e.g., safe working conditions, legal compliance, insurance requirements). Ensures OH&S system covers all stakeholders, not just employees.
  • 27.
    4.3 DETERMINING THESCOPE OF THE OH&S MANAGEMENT SYSTEM •Define boundaries & applicability of the system. Must consider: •Internal & external issues (4.1). •Interested parties’ needs (4.2). •Activities, products, and services. Must be documented and available. Example: “The OH&S management system of ABC Ltd. applies to all operations at the Gandhinagar plant, including employees, contractors, and visitors.”
  • 28.
    4.4 OH&S MANAGEMENTSYSTEM •Establish, implement, maintain, and continually improve an OH&S system in line with ISO 45001 requirements. •Basically bring everything together into a structured → system. Clause 4 is about understanding your world before building the OH&S system. First, know your internal & external context, then understand what workers and stakeholders need, define the scope of your system, and finally build the system around it.”
  • 29.
    CLAUSE 5: LEADERSHIPAND WORKER PARTICIPATION 5.1 Leadership and Commitment 5.2 OH&S Policy 5.3 Organizational Roles, Responsibilities, and Authorities 5.4 Consultation and Participation of Worker
  • 30.
    5.1: LEADERSHIP ANDCOMMITMENT Top management must: • Take overall accountability for OH&S performance. • Ensure integration of OH&S into business processes. • Provide resources (people, technology, budget). • Promote continual improvement. • Support a culture of safety. In simple words: Leaders must walk the talk on safety.
  • 31.
    5.2 OH&S POLICY •Theorganization must establish, implement, and maintain a documented OH&S policy that: •Prevents work-related injury and ill health. •Provides safe and healthy workplaces. •Fulfils legal and compliance obligations. •Commits to worker participation and consultation. •Is communicated to all workers and available to interested parties.
  • 32.
    5.3 ORGANIZATIONAL ROLES,RESPONSIBILITIES, AND AUTHORITIES •Responsibilities must be defined, assigned, and communicated. •Everyone must know their role in safety. •Top management ensures roles are clear (e.g., Safety Officer, Supervisors, Workers).
  • 33.
    5.4 CONSULTATION ANDPARTICIPATION OF WORKER Workers must be: • Consulted before decisions (e.g., policy changes, risk controls). • Encouraged to participate actively (report hazards, join safety committees). •Applies to all levels and functions. •Special attention for non-managerial workers (frontline employees). • Worker participation is not optional – it’s a requirement. Clause 5 is about people – leaders must commit, set policies, assign responsibilities, and involve workers in every step of safety.
  • 34.
    CLAUSE 6: PLANNING •6.1Actions to address risks and opportunities. • Hazard identification. • Risk & opportunity assessment. • Compliance obligations. •6.2 OH&S objectives and planning to achieve them
  • 35.
    6.1 ACTIONS TOADDRESS RISKS AND OPPORTUNITIES. The organization must plan actions to address: •OH&S risks & opportunities •Legal and other requirements •Risks and opportunities related to the OH&S management system itself It has four sub-sections:
  • 36.
    6.1 ACTIONS TOADDRESS RISKS AND OPPORTUNITIES. 6.1.1 General •Identify what needs to be considered when planning the system. •Include hazards, legal obligations, and potential OH&S impacts. 6.1.2 Hazard Identification and Assessment of Risks and Opportunities •Hazard identification must be proactive & ongoing. Consider: • Routine & non-routine activities. • Human behavior (fatigue, stress, ergonomics). • Emergency situations. • People (workers, contractors, visitors, neighbors). • Changes in organization, technology, legislation. •Assess risks (likelihood + consequence). •Identify opportunities (e.g., automation, wellness programs, new PPE).
  • 37.
    6.1 ACTIONS TOADDRESS RISKS AND OPPORTUNITIES. •6.1.3 Determination of Legal and Other Requirements •Identify applicable laws, regulations, and contractual requirements. •Keep them up to date. •Integrate them into operations. •6.1.4 Planning Action •Decide how to address risks, opportunities, and compliance obligations. •Integrate these into the OH&S management system.
  • 38.
    6.2 OH&S Objectivesand Planning to Achieve Them Set OH&S objectives at relevant levels and functions. Objectives must be: •Consistent with OH&S policy. •Measurable (SMART). •Monitored and communicated. •Updated as necessary. •When planning to achieve objectives, define: •What will be done. •Resources required. •Who will be responsible. •Timelines. •How results will be evaluated. Clause 6 is about planning ahead: find hazards, assess risks, spot opportunities, follow laws, and set clear objectives with action plans
  • 39.
    PLANNING FLOW Hazard Identification Risk Assessment& opportunities Legal & Other Requirements OH&S Objectives Action Plan
  • 40.
  • 41.
    CLAUSE 7: SUPPORT •7.1Resources •7.2 Competence •7.3 Awareness •7.4 Communication •7.5 Documentation
  • 42.
    7.1 RESOURCE The organizationmust determine and provide necessary resources (financial, human, technological, infrastructure) to establish, implement, maintain, and continually improve the OH&S system. Example: Providing budget for PPE, hiring a safety officer, allocating funds for training.
  • 43.
    7.2 COMPETENCE Workers mustbe competent (have the right education, training, & experience). Organization must: •Determine required competence. (Skill /Competence mapping) •Provide training or take other actions. •Evaluate effectiveness. •Retain documented evidence (training records, certifications). Example: Forklift drivers must be trained and licensed.
  • 44.
    7.3 AWARENESS Workers mustbe aware of: •OH&S policy. •Their contribution to the OH&S system. •Implications of not following OH&S requirements. •Hazards and risks relevant to their job. Example: Workers knowing that bypassing machine guards can cause severe injury.
  • 45.
    7.4 COMMUNICATION Organization mustestablish processes for internal and external communication. Must decide: •What will be communicated. •When to communicate. •With whom (workers, contractors, regulators, community). •How (meetings, posters, toolbox talks, reports). Example: Reporting accidents to regulators, safety alerts to workers.
  • 46.
    7.5 DOCUMENTATION Two aspects: •Creatingand updating documents must have proper → identification, format, review, and approval. •Control of documented information documents must be → available where needed, protected from loss, unauthorized use, or damage. Example: SOPs, risk assessments, safety training records, policies. Clause 7 ensures we have the right support system – resources, skilled people, awareness, clear communication, and proper documents – to run OH&S smoothly.
  • 47.
    8.OPERATION 8.1 Operational Planning& Control 8.1.2 Eliminating Hazards & Reducing OH&S Risks 8.1.3 Management of Change 8.1.4 Procurement 8.1.4.2 Contractors 8.1.4.3 Outsourcing 8.1.4.1 General 8.1.1 General 8. Operation 8.2 Emergency Preparedness & Response
  • 48.
    8.1 OPERATIONAL PLANNINGAND CONTROL 8.1.1 General The organization must plan, implement, and control processes to meet OH&S requirements. This includes: • Establishing criteria for safe operations. • Controlling outsourced processes. • Maintaining documented information (work instructions, procedures). Example: Safe work procedure for handling chemicals.
  • 49.
    8.1 OPERATIONAL PLANNINGAND CONTROL 8.1.2 Eliminating Hazards and Reducing OH&S Risks Apply the Hierarchy of Controls (in order): • Elimination (remove the hazard). • Substitution (replace with less hazardous). • Engineering controls (isolate people). • Administrative controls (training, work-rest schedules). • PPE (last line of defense). Example: Replace solvent-based paint with water-based (substitution).
  • 50.
    8.1 OPERATIONAL PLANNINGAND CONTROL •8.1.3 Management of Change: Manage changes to processes, equipment, workforce, or regulations to ensure no new risks are introduced. Example: Assess risks before introducing a new machine. 8.1.4 Procurement 8.1.4.1 General : OH&S requirements must be considered in purchasing goods/services. 8.1.4.2 Contractors: Ensure contractors work safely and follow OH&S requirements. 8.1.4.3 Outsourcing: Ensure outsourced processes align with OH&S standards. Example: Contractor safety agreements, PPE provided to suppliers.
  • 51.
    8.2 EMERGENCY PREPAREDNESS& RESPONSE •Organization must prepare for potential emergencies (fire, explosion, chemical spills, natural disasters). •Key requirements: •Identify potential emergencies. •Develop and implement response plans. •Conduct drills and training. •Evaluate and improve plans. Example: Fire evacuation drills every 6 months. Clause 8 is where plans turn into action – safe operations, hazard elimination, controlled changes, safe procurement/contractors, and readiness for emergencies.”
  • 52.
    CLAUSE 9: PERFORMANCEEVALUATION 9.1 Monitoring measurement Analysis & Evaluation 9.1.2 Evaluation of Complianc 9.1.1 General 9.Performance Evaluation 9.3 Management Review 9.2 Internal Audit
  • 53.
    CLAUSE 9: PERFORMANCEEVALUATION 9.1 Monitoring, Measurement, Analysis and Performance Evaluation 9.1.1 General Organization must determine: • What needs to be monitored and measured. • Methods for monitoring and measurement. • Criteria for evaluating OH&S performance. • When results should be analyzed and communicated. 9.1.2 Evaluation of Compliance Organization must evaluate compliance with: • Legal requirements. • Other OH&S obligations (industry standards, client requirements). •Keep records of evaluations and corrective actions if non-compliance found Example: Measuring accident frequency rate, noise levels, air quality, PPE compliance, and legal compliance audits.
  • 54.
    CLAUSE 9: PERFORMANCEEVALUATION 9.2 Internal Audit Conduct internal audits at planned intervals to ensure OH&S system conforms to: • ISO 45001 standard. • Organization’s own requirements. Audit program must consider: • Importance of processes. • Results of previous audits. Auditors must be objective and impartial. Results must be reported to management. Example: Quarterly safety audits of different departments.
  • 55.
    CLAUSE 9: PERFORMANCEEVALUATION 9.3 Management Review Top management must review the OH&S management system at planned intervals (usually annually). Review must include: • Status of previous actions. • Changes in internal/external issues. • Achievement of OH&S objectives. • Information on incidents, nonconformities, and corrective actions. • Opportunities for continual improvement. Outputs include: • Decisions on improvement. • Changes in policy or objectives. • Allocation of resources. Example: Annual management review meeting where leadership evaluates incident statistics and sets new safety targets.
  • 56.
  • 57.
    10.IMPROVEMENT 10.1 General The organizationmust continually improve the suitability, adequacy, and effectiveness of the OH&S management system. Means: never settle, always find ways to get safer.
  • 58.
    10.2 INCIDENT, NONCONFORMITYAND CORRECTIVE ACTION If an incident (accident, near miss, unsafe condition) or nonconformity occurs, the organization must: • React quickly control & correct it. → • Deal with the consequences. • Investigate to determine the root cause. • Take corrective actions to prevent recurrence. • Review effectiveness of the action. • Update risk assessments, procedures, or system if needed. • Document everything. Example: Worker slips immediate first aid + investigation root cause = oil → → leak corrective action = fix machine + update maintenance schedule. → 10.IMPROVEMENT
  • 59.
    10.3 CONTINUAL IMPROVEMENT 10.IMPROVEMENT Lookfor opportunities to improve OH&S performance on an ongoing basis. Sources of improvement can come from: • Incident investigations. • Audit findings. • Worker suggestions. • New technology. • Management reviews. Example: Installing noise-reducing enclosures after workers reported hearing difficulties, even though legal limits weren’t exceeded Clause 10 is about learning from mistakes and successes – fixing problems, preventing recurrence, and continually improving safety performance.
  • 60.
  • 61.
    MODULE 2: ACCREDITATION, CERTIFICATION & TYPES OF AUDIT Main Document to be considered Terms & Definitions Types of Audits Certification Body Audits
  • 62.
    MAIN DOCUMENT TOBE CONSIDERED ISO/IEC 17021-1:2015- Conformity Assessment– Requirements for bodies providing audit & certification on management systems Part 1: Requirements ISO19011:2018-Guidelines for auditing management systems ISO 45001:2018- Occupational health & safety management system Requirements with Guidance for use
  • 63.
    TERMS AND DEFINITIONS •Audit:Systematic, independent, and documented process for obtaining evidence and evaluating it objectively. •Auditor: Person with competence to conduct audits. •Audit program: Set of one or more audits planned for a specific period. •Audit Criteria are the set of policies, procedures, or requirements against which the audit evidence is compared to determine conformity. •Audit evidence is the recorded information, statements of fact, or observations collected by the auditor to determine whether the audit criteria are being met. •Audit finding is the result of the evaluation of audit evidence against audit criteria. •Audit conclusion is the overall outcome of the audit, derived from the audit findings and the evaluation of the audit objectives. • Audit client: is the person or organization that requests the audit. • Auditee: is the person or organization being audited. • Audit Team: Audit team is a group of one or more auditors, led by a team leader, who collectively conduct an audit. • Technical Expert : A technical expert is a person who provides specific knowledge or expertise to the audit team regarding technical, operational, or specialized areas. • Observer : An observer is a person who attends an audit to gain experience or for other purposes but does not participate in audit activities such as collecting evidence, evaluating conformity, or making audit findings. • Guide: A guide is a person designated by the auditee to assist the audit team • Audit Plan: An audit plan is a documented description of the scope, objectives, and schedule of an audit. Audit Scope:Audit scope is the extent and boundaries of an audit, specifying what is included and excluded in terms of: Processes or activities, Departments or functions,Locations or sites,Time period
  • 64.
    DIFFERENT TYPE OFAUDITS First Party audit: Internal Audit Second Party Audit: External provider Audit Other external interested party audit Third party Audits: Certification and / or accreditation audit Statuary Regulatory & Similar audit Combined Audits : Carried out together at a single auditee on two or more management systems Joint Audits: Audit Carried out at a single auditee by two or more auditing organization
  • 65.
    CERTIFICATION BODY AUDITS Certification Surveillance( Planned or Unplanned Recertification Special Audit Transfer/suspension
  • 66.
  • 67.
    INITIAL & CERTIFICATIONAUDIT Divided into Stage 1 and Stage 2: •Stage 1 Audit: Review of client’s management system documentation, readiness for certification, site-specific conditions, and preparedness. •Stage 2 Audit: On-site evaluation of implementation, effectiveness, and compliance with the standard.
  • 68.
    SURVEILLANCE ACTIVITIES •Conducted atleast once a year to ensure ongoing compliance. •Includes on-site audits, document reviews, interviews, or off-site reviews. Recertification •Full re-assessment audit before the certificate expires (typically every 3 years). •Must consider performance over the certification cycle, complaints, changes in system/operations.
  • 69.
    SPECIAL AUDIT •Conducted when: •Significantchanges occur (legal, organizational, scope). •Complaints or concerns about nonconformity arise. •May be short-notice audits. TRANSFER/SUSPENSION •Suspension may happen due to: • Failure to maintain compliance. • Not allowing surveillance or recertification audits. • Misuse of certification mark. •Withdrawal if issues are not resolved. •Reduction of scope if only part of the system is affected.
  • 70.
    CERTIFICATION PROCESS -THIRD-PARTY AUDIT -ACCORDING TO ISO/IEC 17021-1:2015 (3 YEARS AUDIT CYCLE)
  • 71.
    PRINCIPALS OF AUDITING Integrity:the foundation of professionalism • Fair presentation: the obligation to report truthfully and accurately • Due professional care: the application of diligence and judgement in auditing • Confidentiality: security of information • Independence: the basis for the impartiality of the audit and objectivity of the audit conclusions • Evidence-based approach: the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process • Risk-based approach: an audit approach that considers risks and opportunities
  • 72.
    PDCA OF ISO45001:2018 P D C A
  • 73.
    MANAGING AN AUDITPROGRAMME Establishing audit programme objectives • Determining and evaluating audit programme risks and opportunities Establishing the audit programme • Roles and responsibilities of the individual(s) managing the audit programme • Competence of individual(s) managing audit programme Establishing extent of audit programme • Determining audit programme resources
  • 74.
    MANAGING AN AUDITPROGRAMME Implementing audit programme •Defining the objectives, scope and criteria for an individual audit establishing extent of audit Selecting and determining audit methods • Selecting audit team members • Assigning responsibility for an individual audit to the audit team leader Managing audit programme results • Managing and maintaining audit programme records • Monitoring audit programme •Reviewing and improving audit programme
  • 75.
    AUDIT OBJECTIVES, AUDITSCOPE AND AUDIT CRITERIA FOR THIRD PARTY CERTIFICATION AUDIT ACCORDING TO ISO 45001:2015 Audit objectives:- • Determination of the conformity of the client’s management system, or parts of it with audit criteria. • Evaluation of the ability of the management system to ensure the organization meets applicable statutory, regulatory and contractual requirements. • Evaluation of the effectiveness of the management system to ensure the client organization is continually meeting its specified objectives. • As applicable, identification of areas for potential improvement of the management system
  • 76.
  • 77.
    ROLES, RESPONSIBILITIES, COMPETENCEREQUIREMENTS • LEAD AUDITORS • AUDITORS • TECHNICAL EXPERTS • AUDITEES
  • 78.
    LEAD AUDITOR RESPONSIBILITIES Aperson qualified and authorised to manage a system Audit. • Plan the Audit and organise a team to conduct the Audit. • Manage all aspects of the Audit ‘on site’ • A person qualified and authorised to perform all, or a portion of, an audit. • To audit allocated areas/ activities and report findings to the Lead Auditor. • Be aware of the needs and expectation of the Auditee. • Consider local culture and customs.
  • 79.
    AUDITOR PERSONAL BEHAVIOUR Thepersonal attributes an Auditor needs to develop, being: • Ethical • Open-minded • Diplomatic • Observant • Perceptive • Versatile • Tenacious • Decisive • Self-reliant • Able to act with fortitude • Open to improvement • Culturally sensitive • Collaborative
  • 80.
    AUDITEE’S RESPONSIBILITIES Co-operate withthe Auditor in the planning and conducting of the Audit. • Provide access for the Audit team. • Provides guides. • Attend the opening and closing meetings. • Address and implement corrective action. Guides Selected by the Auditee management to accompany the Auditor. • May or may not be authorised to agree and resolve non-compliances • Will normally assist the Auditor with identifying procedures, activities and staff
  • 81.
    ASSIGN RESPONSIBILITIES TOGUIDES & OBSERVERS Consider asking or allowing to accompany your audit team: • guides (appointed by the auditee): roles and responsibilities - assisting the auditors, arranging access, ensuring safety and security • observers (e.g. regulator or other interested parties) : they should not interfere with the audit.
  • 82.
    OTHER AUDIT ACTIVITY Theauditors audit the area assigned to them in the audit plan • Sample the system • Collect objective evidence of system effectiveness • Compare findings from checklist with requirements • Decide compliance or noncompliance • Audit team daily meeting [or more frequently • Decide on system effectiveness • Agree and categorise non-conformities • Hold a meeting daily with auditee’s representatives, and at the end of the audit, prior to the closing meeting. • Prepare summary report with conclusions and indicate recommendations
  • 83.
    CASE STUDY ,CS-2 Responsibilitiesand Authority of Team Leader , Team Member, Guide and Observer
  • 84.
    INITIAL INFORMATION –OFFERED BY CB TO TEAM LEADER / OBTAINED BY TEAM LEADER • Details of site(s) and company • Details of processes and products • Number of staff, shift working • Scope of the management system • Audit criteria: standard, documents, specific regulations etc.
  • 85.
  • 86.
    STAGE 1 AUDIT -Performing review of documented information Audit the client's management system documentation; • Evaluate the client's location and site-specific conditions and to undertake discussions with the client's personnel to determine the preparedness for the stage 2 audit; • Review the allocation of resources for stage 2 audit and agree with the client on the details of the stage 2 audit; • Evaluate if the internal audits and management review are being planned and performed, and that the level of implementation of the management system substantiates that the client is ready for the stage 2
  • 87.
    CASE STUDY CS-3 PERFORMING REVIEW OF DOCUMENTED INFORMATION (DOCUMENT REVIEW)
  • 88.
    AUDIT PLAN -PREPARING The audit team leader prepare an audit plan based on the documentation provided by the auditee, considering: • the appropriate sampling techniques. • the collective competence of the audit team. • the risks to the organization created by the audit. The audit plan should cover: • audit objectives • audit scope and processes to be audited • audit criteria • locations, dates, time and duration of audit activities • audit methods to be used • audit team members, guides and observers • appropriate resources to critical areas of the audit.
  • 89.
    CASE STUDY -CS-4 AUDIT PLAN
  • 90.
    STAGE 2 AUDIT Thepurpose of the stage 2 audit is to evaluate the implementation, including effectiveness • information and evidence about conformity to all requirements of the applicable management system standard. • client's management system and performance as regards legal compliance • operational control of the client's processes; • internal auditing and management review • management responsibility for the client's policies; • performance monitoring, measuring, reporting and reviewing against key performance objectives and targets (consistent with the expectations in the applicable management system standard.
  • 91.
    BEFORE STAGE 2AUDIT ACTIVITIES – MADE BY TEAM LEADER • Clarifications regarding audit plan • Details related to auditee organization • Conclusions related documentation review
  • 92.
    EXERCISE -1 Preparing documentedinformation for audit check lists – Exercise 1
  • 93.
    THE OPENING MEETING •The language to be used during the audit • Review the plan • matters relating to confidentiality and information security; • Provision of guides & Personal Protective Equipment (PPE) • Advise that the audit findings will be based on a sample taken. • Explain how findings will be categorized (non-conformities, etc.) • Check availability of facilities • Conditions under which the audit may be terminated • any system for feedback from the auditee on the findings or conclusions of the audit, including complaints or appeals. • Agree arrangements for the closing meeting • Invite questions for clarification.
  • 94.
    VERY IMPORTANT! Punctuality isimportant! Arrive on time! • The meeting should be brief and to the point
  • 95.
    CASE STUDY -5OPENING MEETING
  • 96.
    PROBLEMS / ISSUESENCOUNTERED • Auditors may not always receive full co-operation from the Auditee, it is therefore important to recognise when such situations are occurring and take appropriate action. • Such instances may include: • Avoid answering questions • Going missing • Delaying the Audit • Constant interruptions, etc.