Establishing Audit Criteria Under ISO 45001 Clause 9.2

Purpose and Function of Audit Criteria in ISO 45001

Under ISO 45001:2018 Clause 9.2.2 b), an organisation must define the audit criteria and scope for each internal audit. Audit criteria represent the set of policies, procedures, standard clauses, legal obligations, and operational requirements used as a reference against which audit evidence is evaluated. Establishing precise audit criteria ensures internal audits produce objective and actionable evaluations of the management system.

Without established criteria, internal audits risk becoming subjective inspections based on auditor preference. Clause 9.2.1 dictates that internal audits must evaluate whether the system conforms to the organisation's own requirements, including the OH&S policy and objectives, and whether it conforms to ISO 45001. Audits must also verify whether the system is effectively implemented and maintained.

Defining robust audit criteria enables internal auditors to systematically measure performance, identify nonconformities, and uncover opportunities for continual improvement under Clause 10.3. Clear criteria also support top management accountability under Clause 5.1 by providing verified data regarding operational control.

Core Inputs for Defining Audit Criteria Under Clause 9.2

Establishing audit criteria requires synthesizing internal and external requirements into a reference framework. Auditors cannot rely solely on ISO 45001 clauses. A compliant criteria framework incorporates context, hazard risk profiles, legal duties, and operational controls established under Clause 8.1.1.

The primary foundation consists of mandatory ISO 45001 clauses alongside legal requirements identified under Clause 6.1.3. These external boundaries dictate compliance baselines that the management system must satisfy. Auditors must review legal registers, permits, and statutory codes of practice to establish legal evaluation criteria.

The second foundation comprises internal requirements. These include corporate OH&S policy commitments under Clause 5.2, measurable objectives under Clause 6.2, hazard identification outcomes under Clause 6.1.2.1, standard operating procedures, and risk control criteria under Clause 8.1.2. Criteria must also incorporate worker consultation outputs under Clause 5.4.

Audit Evaluation Matrix for Establishing Audit Criteria

Internal auditors and quality managers must systematically verify that audit criteria are properly structured and applied during internal assessments. The following matrix details what auditors evaluate during a review and the documented evidence required to demonstrate conformity under Clause 9.2.

Step-by-Step Procedure for Establishing Audit Criteria

Operationalising Clause 9.2.2 b) requires a structured approach to defining, documenting, and applying audit criteria across internal audit activities. Compliance leads must ensure criteria are tailored to the specific operational unit, hazard profile, and activity being audited.

Organisations should follow a systematic, five-step procedure when establishing audit criteria:

• Define physical boundaries, operational processes, shift patterns, and organizational units included in the audit scope under Clause 9.2.2 b).
• Gather applicable requirements, including relevant ISO 45001:2018 clauses, legal obligations under Clause 6.1.3, and industry codes of practice.
• Extract internal criteria from documented information, including OH&S policy commitments under Clause 5.2, active objectives under Clause 6.2, and operational control criteria under Clause 8.1.1.
• Synthesize gathered requirements into a tailored audit plan or checklist, ensuring questions explicitly cite the reference standard, legal duty, or internal procedure evaluated.
• Review and finalize audit criteria with the lead auditor and process owners prior to execution, retaining criteria as documented information under Clause 9.2.2 f).

Example

A manufacturing facility plans an internal audit of its chemical storage facility under Clause 9.2.2. Rather than using a generic checklist, the lead auditor establishes criteria by integrating three distinct layers of requirements.

First, the auditor includes normative ISO 45001 requirements under Clause 8.1.2 for the hierarchy of controls and Clause 8.2 for emergency preparedness. Second, the auditor incorporates statutory legal requirements under Clause 6.1.3 governing chemical storage thresholds and containment capacities. Third, the auditor adds internal requirements from the plant's chemical safety procedure, which mandates weekly secondary bund inspection logs and specific protective equipment.

During audit execution, the auditor evaluates physical conditions against this criteria set, discovering that secondary containment bunds lack inspection records required by the internal procedure. Because criteria were explicitly established, the auditor issues a precise nonconformity against internal procedural controls under Clause 9.2.1 a), enabling targeted corrective action under Clause 10.2.

Before your audit

• Verify that documented audit plans explicitly state the audit criteria and scope for each scheduled audit.
• Confirm that audit criteria incorporate mandatory clauses of ISO 45001:2018 applicable to the audited process.
• Check that relevant legal requirements and regulatory permits are integrated into the audit evaluation criteria.
• Ensure internal standard operating procedures, work instructions, and risk control criteria are included in audit protocols.
• Confirm that OH&S policy commitments and active Clause 6.2 objectives are embedded into evaluation checklists.
• Verify that audit criteria account for outputs from worker consultation under Clause 5.4 and hazard assessments under Clause 6.1.2.1.
• Check that assigned auditors are competent and understand how to interpret and apply the established criteria.
• Retain all documented information defining audit criteria, audit plans, and completed evaluation working papers under Clause 9.2.2 f).

Questions people ask

What is the difference between audit scope and audit criteria under ISO 45001?

Audit scope defines the boundaries and extent of an audit, such as physical locations, organizational units, activities, and timeframes. Audit criteria represent the set of policies, procedures, standard clauses, and legal requirements used as a reference against which audit evidence is evaluated.

Can an organisation use ISO 45001 clauses as its sole audit criteria?

No, relying solely on ISO 45001 standard clauses is insufficient. Clause 9.2.1 a) mandates evaluating conformity to the organisation's own requirements for its management system, which includes internal operating procedures, legal requirements under Clause 6.1.3, and policy commitments.

Who is responsible for establishing audit criteria under Clause 9.2?

The organisation, typically through its audit programme manager or assigned lead auditor, is responsible for establishing audit criteria under Clause 9.2.2 b). Non-managerial workers must also be consulted regarding audit programme planning under Clause 5.4 d) 8).

How often should audit criteria be reviewed and updated?

Audit criteria must be reviewed and updated whenever changes occur to ISO 45001 standards, legal duties under Clause 6.1.3, internal operating procedures under Clause 8.1.3, or management system objectives under Clause 6.2.

What documented evidence must be retained to prove audit criteria were established?

Under Clause 9.2.2 f), organisations must retain documented information as evidence of audit programme implementation and audit results. This includes formal audit plans, evaluation criteria checklists, working papers, and finalized audit reports.

Reference documents

• ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use