Auditing Auditor Impartiality & Objectivity in ISO 45001 Clause 9.2

What the Requirement Is, and Why It Exists

ISO 45001 establishes a comprehensive internal audit governance framework under Clause 9.2 to evaluate management system performance and compliance. Under Clause 9.2.1, organisations must conduct internal audits at planned intervals to determine whether the occupational health and safety management system conforms to internal requirements, aligns with ISO 45001 requirements, and remains effectively implemented. Under Clause 9.2.2 c), organisations must select auditors and conduct audits to ensure objectivity and the impartiality of the audit process. This mandate ensures that audit findings reflect objective operational realities rather than self-interested operational bias.

This impartiality framework applies across all management levels, including top management, compliance leads, audit managers, internal auditors, and non-managerial workers. Under Definition 3.32, an audit is defined as a systematic, independent, and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Allowing personnel to audit their own direct work processes severely compromises audit independence and obscures critical safety risks. Quality managers and compliance leads must structure audit programmes that safeguard auditor independence, engage relevant stakeholders, and maintain audit-ready documented information.

Technical Nuances: Auditor Impartiality and Process Objectivity

Understanding the technical nuances of Clause 9.2.2 c) requires examining standard definitions and operational safeguards defined across Clause 9.2 and Annex A.9.2. Under Clause 9.2.2 a), the organisation must plan, establish, implement, and maintain an audit programme considering process importance and prior audit results. Clause 9.2.2 b) requires defining specific audit criteria and scope for each audit. Clause 9.2.2 c) explicitly separates auditor selection from operational execution, preventing individuals from reviewing activities for which they hold direct operational responsibility.

Annex A.9.2 provides crucial operational guidance for satisfying Clause 9.2.2 c) across organisations of varying scale. The guidance notes that organisations may establish objectivity and impartiality by creating processes that separate auditors' roles as internal auditors from their normal assigned duties. Alternatively, organisations may engage external competent persons to conduct internal audits on their behalf. Non-managerial workers must be consulted when planning, establishing, implementing, and maintaining audit programmes in accordance with Clause 5.4 d) 8).

Example

A manufacturing facility prepares for its annual internal audit cycle under Clause 9.2. Under Clause 5.4 d) 8), the compliance lead consults non-managerial health and safety representatives to schedule departmental audits. To satisfy Clause 9.2.2 c), the lead assigns an assembly supervisor to audit warehouse logistics while contracting an external auditor for high-risk chemical operations. During the internal audit, the external auditor reviews operational controls under Clause 8.1 without operational bias, documenting objective findings and confirming full compliance with Clause 9.2.2 c).

Audit Verification Procedure and Requirement Matrix

Auditing Clause 9.2.2 c) impartiality controls requires a structured, multi-step verification procedure that evaluates auditor assignment schedules, independence declarations, and reporting protocols. Internal auditors must execute the following four-step procedure during internal audits to confirm process objectivity.

• Review internal audit procedures and auditor selection criteria under Clause 9.2.2 a) to confirm formal rules prohibiting self-auditing.
• Cross-reference auditor assignment rosters with operational organigrams to verify that auditors have no direct operational responsibility over assigned audit scopes.
• Inspect worker consultation records under Clause 5.4 d) 8) to verify that non-managerial workers contributed to audit programme planning and scheduling.
• Sample completed audit reports under Clause 9.2.2 d) to evaluate whether findings, nonconformity statements, and corrective actions reflect objective audit evidence.

Before your audit

• Verify that internal audit procedures explicitly prohibit auditors from auditing their own direct work processes.
• Confirm that auditor selection criteria evaluate technical competence and operational independence under Clause 9.2.2 c).
• Inspect auditor assignment logs against departmental organigrams to verify absence of operational conflict of interest.
• Check evidence demonstrating non-managerial worker consultation during audit programme planning under Clause 5.4 d) 8).
• Verify that external auditors engaged for internal auditing possess verified competency records under Clause 7.2.
• Confirm that internal audit criteria, scope, and methods are defined for each scheduled audit under Clause 9.2.2 b).
• Inspect retained documented information to confirm that audit results are reported to relevant managers and workers under Clause 9.2.2 d).

Questions people ask

Can a small organisation allow department heads to audit their own departments under ISO 45001?

ISO 45001 explicitly prohibits self-auditing under Clause 9.2.2 c) to maintain audit process objectivity and impartiality. Small organisations can satisfy this requirement by cross-auditing between different departments, separating regular duties from audit roles, or contracting qualified external auditors under Annex A.9.2. This ensures audit findings remain objective and reliable.

What is the difference between an internal audit and an external audit in ISO 45001?

Under Definition 3.32 Note 1 and Note 2, an internal audit is a first-party audit conducted by the organisation itself or by an external party acting on its behalf. External audits include second-party audits conducted by interested parties such as customers and third-party audits conducted by independent certification bodies. Both audit types evaluate conformity against defined management system criteria.

Must non-managerial workers be involved in the ISO 45001 internal audit process?

Under Clause 5.4 d) 8), organisations must emphasise the consultation of non-managerial workers when planning, establishing, implementing, and maintaining internal audit programmes. Furthermore, Clause 9.2.2 d) mandates that relevant audit results must be reported to workers and worker representatives. Worker involvement ensures that practical workplace risks are addressed during audits.

What documented information must be retained for Clause 9.2 internal audits?

Under Clause 9.2.2 f), organisations must retain documented information as evidence of the implementation of the audit programme and the audit results. Retained evidence typically includes master audit schedules, auditor selection records, audit plans, completed checklists, final audit reports, and nonconformity logs. Retaining these records demonstrates compliance during external audits.

Reference documents

• BS ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use