Auditing ISO 45001 Clause 9.2 Internal Audit Programmes

Purpose and Scope of Clause 9.2 Requirements

Under ISO 45001:2018 Clause 9.2, an organisation must conduct internal audits at planned intervals. The primary purpose of this requirement is to evaluate whether the occupational health and safety management system conforms to the organisation's own requirements, aligns with the standard's provisions, and remains effectively implemented and maintained. Internal auditing provides top management and workers with objective information on system health and operational discipline.

Clause 9.2 consists of two distinct sub-clauses: Clause 9.2.1 covering general audit objectives, and Clause 9.2.2 governing the internal audit programme. Internal audits act as a vital performance evaluation tool within the Plan-Do-Check-Act cycle. Rather than treating auditing as a fault-finding exercise, Clause 9.2 establishes an independent process to identify system deficiencies, assess control effectiveness, and highlight opportunities for continual improvement.

The extent and scope of the internal audit programme depend on the complexity and maturity of the occupational health and safety management system. Factors such as geographical footprint, high-risk operational hazards, legal obligations, and past incident trends directly influence how audits are scheduled and resourced.

Structuring the Internal Audit Programme and Criteria

Clause 9.2.2 a) requires the organisation to plan, establish, implement, and maintain an audit programme. The programme must define the frequency, methods, responsibilities, consultation requirements, planning criteria, and reporting arrangements. When determining audit schedules, the organisation must account for the importance of the processes concerned and the results of prior audits. High-hazard operations or areas with recurring nonconformities demand more frequent audit coverage.

Clause 9.2.2 b) mandates defining specific audit criteria and scope for each individual audit. Audit criteria represent the standards, policies, procedures, legal requirements, and operational controls against which audit evidence is evaluated. The audit scope defines the boundaries, physical locations, organizational units, activities, and timeframes covered by the assessment.

Clause 9.2.2 c) dictates that auditors must be selected and audits conducted to ensure objectivity and the impartiality of the audit process. Auditors must not audit their own work or operational responsibilities. Objectivity can be established by separating auditor duties from normal work roles or utilizing external auditors.

Audit Evaluation Matrix for Internal Audit Programmes

Internal auditors and compliance leads must evaluate both the design of the audit programme and the execution of individual audits. The following matrix outlines what auditors check during an evaluation and the documented evidence required to demonstrate conformity under Clause 9.2.

Executing Audits and Reporting Results to Stakeholders

Executing a compliant internal audit programme requires adhering to systematic protocols that ensure thorough evidence collection and transparent reporting. Information gathered during audits must be evaluated against defined criteria to determine conformity or identify nonconformities.

Organisations must follow a structured, five-step procedure when implementing an internal audit under Clause 9.2:

• Formulate a risk-based audit programme specifying audit frequency, scope, criteria, and methods, consulting non-managerial workers as required by Clause 5.4 d) 8).
• Select competent, impartial auditors who have no direct operational responsibility over the activities being assessed to guarantee objectivity.
• Conduct the audit by examining documented information, observing physical workplace conditions, and interviewing workers across operational shifts.
• Issue formal audit reports detailing findings and nonconformities, distributing results to relevant managers, workers, worker representatives, and interested parties under Clause 9.2.2 d).
• Track corrective actions initiated under Clause 10.2, verify the effectiveness of implemented solutions, and submit audit outputs to management review under Clause 9.3.

Example

A logistics firm establishes its annual internal audit programme under Clause 9.2.2. The compliance manager assigns a trained warehouse supervisor to audit the maintenance department. However, during the audit, the auditor evaluates forklift maintenance procedures that he personally authored and approved in his daily operational role.

During a subsequent certification assessment, the lead auditor identifies this arrangement as a major nonconformity against Clause 9.2.2 c) due to a breach of impartiality. To rectify the finding under Clause 10.2, the organisation revises its audit procedure, re-assigns the warehouse audit to an independent quality engineer, and re-audits the maintenance process to ensure objective evaluation.

Before your audit

• Verify that a documented internal audit programme exists covering all scope areas of the occupational health and safety management system.
• Ensure audit frequencies reflect the importance of operational hazards, risk levels, and previous audit results.
• Confirm that documented evidence demonstrates consultation with non-managerial workers during audit programme planning.
• Check that selected auditors are competent and operationally independent from the activities they inspect.
• Review individual audit plans to confirm defined audit criteria, scope, boundaries, and evaluation methods are established.
• Verify that audit findings are formally communicated to relevant managers, workers, and worker representatives.
• Confirm that nonconformities identified during internal audits have triggered corrective action processes under Clause 10.2.
• Retain documented information as evidence of audit programme implementation, audit reports, and follow-up verification.

Questions people ask

Does ISO 45001 mandate a specific internal audit frequency?

No, ISO 45001 Clause 9.2.1 requires internal audits at planned intervals but does not prescribe a fixed frequency. Organisations must determine audit schedules based on process complexity, risk assessments, legal duties, and previous audit outcomes.

Can an internal auditor audit their own department under ISO 45001?

No, Clause 9.2.2 c) explicitly requires organisations to select auditors and conduct audits to ensure objectivity and impartiality. An auditor must not audit activities or processes for which they hold direct operational responsibility.

Must internal audit results be shared with non-managerial workers?

Yes, Clause 9.2.2 d) mandates that relevant audit results must be reported to workers, worker representatives where they exist, and relevant interested parties, ensuring transparency across the management system.

What is the relationship between internal audits and management review?

Under Clause 9.3 d) 4), internal audit results serve as a mandatory input to the management review process. Top management evaluates audit trends to assess system suitability, adequacy, effectiveness, and resource needs.

What documented information must be retained for Clause 9.2 compliance?

Under Clause 9.2.2 f), organisations must retain documented information as evidence of the implementation of the audit programme and the actual audit results, including audit plans, checklists, reports, and corrective action records.

Reference documents

• ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use