ISO-45001-Lead-Auditor PECB Certified OHSMS ISO 45001 Lead Auditor Exam Questions and Answers

Clause 8.1.4.2 requires the organisation to coordinate its procurement processes with contractors to identify hazards and assess and control OH and S risks arising from contractor activities and operations. A establishes explicit OH and S requirements within the contractual relationship, creating a controlled mechanism through which Shelf-Fit can specify and enforce relevant safety expectations. B requires contractors to provide site-specific risk-assessment information before work begins, enabling Shelf-Fit to coordinate hazard identification and risk controls proactively rather than relying on contractor expertise or historical absence of incidents. The existing ODT confirms that contractor coordination must cover hazard identification, assessment and control of OH and S risks. Auditing contractors only after incidents is reactive, while chemical retention or merely suggesting training does not establish systematic coordination. ISO 45001 certification of every contractor is also not required by Clause 8.1.4.2.

ISO 45001 Clause 7.2 Competence requires the organization to:

determine the necessary competence of workers that affect or can affect OH and S performance;

ensure workers are competent, including the ability to identify hazards;

where applicable, take actions to acquire and maintain competence and evaluate the effectiveness of those actions; and

retain appropriate documented information as evidence of competence.

Based on that wording, C is clearly correct because the clause explicitly says workers must be competent, including having the ability to identify hazards. If there is no evidence of that ability, this directly supports a nonconformity against Clause 7.2.

F is also correct because Clause 7.2 requires the organization to determine the competence needed for roles and ensure workers meet it. If there is no evidence that workers’ knowledge and skills are assessed against role requirements, the organization cannot demonstrate that competence has been determined and verified.

H is the third correct answer because Clause 7.2 requires the organization to retain documented information as evidence of competence. Attendance on OH and S training is not, by itself, full proof of competence, but the absence of training records can still support a finding that the organization lacks documented evidence related to competence development and maintenance.

Why the others are not Clause 7.2 findings:

A belongs to Clause 7.3 Awareness, which requires awareness of the consequences of not conforming.

B also relates more to Clause 7.3 Awareness, which includes awareness of the ability to remove themselves from imminent and serious danger.

D is also Clause 7.3 Awareness, because workers must understand their contribution to the effectiveness of the OHSMS.

E relates to consultation and participation under Clause 5.4, not competence.

G refers to quality policy and objectives, which are not ISO 45001 OH and S competence requirements.

Clause 10.2 of ISO 45001 requires organizations to investigate incidents, determine root causes, and implement corrective actions to prevent recurrence.

Analysis of Options:

A. Check whether corrective actions were taken.This directly relates to the requirement to implement corrective actions to address the identified risks and hazards. Failure to do so would indicate nonconformity.

B. Determine whether the Health and Safety Authority was notified.Notification is a legal requirement in certain jurisdictions, but it is not explicitly required under ISO 45001 unless the legal context demands it.

C. Establish whether the root cause was determined.Root cause analysis is fundamental for effective corrective action. Without this, corrective measures may not address the underlying problem.

D. Find out when the operator ' s machine was last subject to maintenance.While maintenance is important, it does not directly address the incident ' s nonconformity.

E. Find out whether the operator was sent to the hospital.Sending the operator to the hospital is a reactive step and not relevant to compliance with Clause 10.2.

F. Interview the operator about PPE usage.This is relevant but insufficient for determining compliance with Clause 10.2.

ISO References:

Clause 10.2: Investigation of incidents, determination of causes, and implementation of corrective actions.

Clause 8.1.2: Hierarchy of controls and risk reduction.

Activities following the closure of a third-party audit are generally related to improving the audit process and addressing any unresolved issues.

Analysis of Options:

A. Addressing any audit complaints:Correct. Post-audit, complaints or concerns from stakeholders are addressed to improve the audit process and maintain credibility.

B. Conducting a closing meeting:Incorrect. The closing meeting occurs before the audit is closed.

C. Conducting a review of opportunities for improvement:Correct. Reviewing opportunities for improvement post-audit helps in refining processes and aligning them with organizational goals.

D. Revising the audit ' s objectives:Incorrect. Audit objectives are established during the planning phase, not after the audit has been closed.

E. Updating risks and opportunities to the audit programme:Incorrect. Updates to risks and opportunities occur during ongoing audits, not specifically post-audit.

F. Writing the audit report:Incorrect. The audit report is prepared before the audit is officially closed.

ISO References:

Clause 9.2.2: Audit process review.

ISO 19011:2018, Clause 6.7: Managing complaints and follow-up.

Clause 8.1.2 of ISO 45001 pertains to Eliminating Hazards and Reducing OH and S Risks. Organizations must implement appropriate controls to manage workplace hazards effectively.

Issue Identified:The kitchen environment at the audited site presents multiple hazards, including:

Oil spillage creating a slip hazard.

Open drums of waste material posing a chemical or hygiene hazard.

Unsecured knives and cleavers increasing the risk of cuts.

Boiling water left unattended, posing a risk of burns.

Lack of visible fire extinguishers or fire blankets, increasing fire risk.

Analysis of Options:

A. Failure to reduce risks associated with working in the kitchen.This option accurately captures the broader failure to implement effective measures to eliminate or reduce hazards across multiple areas in the kitchen.

B. Measures to prevent slippage in the kitchen from waste cooking oil were not taken.This is specific to one hazard (oil spillage) and does not address other significant risks observed, such as fire safety or sharp tools.

C. Staff are at risk of serious injury while working in the kitchen.While true, this is more of a general observation and does not address the root cause of the hazards or the failure of controls.

D. Training of the kitchen staff was not effective enough to prevent poor safety awareness in the kitchen area.Although training deficiencies may contribute to the issue, this option does not reflect the overarching systemic failure to manage hazards effectively.

Best Description of the Nonconformance:Failure to reduce risks associated with working in the kitchen (Option A) is the most comprehensive finding, reflecting the organization’s lack of adequate controls to mitigate hazards.

ISO References:

Clause 8.1.2: Organizations must establish controls to eliminate or minimize OH and S risks systematically.

Clause 7.2: Ensuring competency through training is important but must be coupled with hazard control measures.

Analysis of Options:

A. Integrated Management System:Correct. An Integrated Management System (IMS) combines multiple standards like ISO 45001, ISO 14001, and ISO 9001, addressing environment management as part of the integration.

B. ISO 14501:Incorrect. ISO 14501 pertains to milk and milk products, not environmental management.

C. ISO 45001:Incorrect. ISO 45001 focuses on Occupational Health and Safety, not environmental management.

D. ISO 14001:Correct. ISO 14001 is the primary standard for Environmental Management Systems.

ISO References:

ISO 14001: Environment Management Systems.

Integrated Management Systems: Combines standards like ISO 14001 and ISO 45001.

The correct answer is A. Audit findings that pose a significant health and safety risk.

In management system auditing practice, the audit team leader is expected to maintain communication with the auditee during the audit, especially when serious issues are identified. Where audit evidence indicates a significant risk, this should be communicated without waiting for the closing meeting, so the organization can take prompt action if needed. ISO guidance on conducting audits emphasizes communication during the audit and presentation of findings and conclusions at the closing meeting, while serious risks are handled immediately rather than being delayed. (ISO)

Why the other options are not correct:

B. The outcome of the audit, including the conclusion is normally communicated at the closing meeting, not before it. (Advisera)

C. Diverging opinions within the audit team are internal audit team matters. Only unresolved issues relevant to audit results may be raised appropriately, but internal team differences are not the key information to communicate beforehand.

D. Performance of individual workers when responding to health and safety-related questions is not the purpose of audit reporting. A management system audit evaluates the system and its implementation, not individual worker appraisal.

Therefore, the information that should be communicated to the auditee before the closing meeting is:

A. Audit findings that pose a significant health and safety risk.

Audit-team selection must be competence based. Option E is appropriate because an OH and S auditor needs sufficient understanding of applicable statutory, regulatory and other requirements relevant to the organisation ' s activities. This enables the auditor to recognize applicable audit criteria and evaluate objective evidence in the correct regulatory context. Option F is also essential: auditors must communicate clearly during interviews, team discussions, audit findings and closing activities so that evidence and conclusions are accurately understood. An auditor does not need expert-level knowledge of every process; technical experts can supplement the team where specialized competence is required. A history of complaints, unquestioning cooperation with a leader or an intentionally unstructured personal approach are not valid competence criteria. ISO 19011 specifically frames auditor competence around knowledge, skills, professional behaviour and the ability of the overall audit team to achieve the audit objectives.

The available audit evidence demonstrates that the organisation has recognised the hazards arising from the equipment change and has implemented an appropriate temporary control: restaurant 2 is closed to the public until replacement equipment is installed and personnel are trained. ISO 45001 Clause 8.1.3 requires organisations to establish processes for implementing and controlling planned temporary and permanent changes that can affect OH and S performance. The auditor should assess conformity against requirements and objective evidence, not criticise legitimate business decisions. There is no evidence that restaurant 2 is operating without required emergency equipment; consequently, raising a legal-compliance nonconformity is unsupported. Nor should the auditor prescribe improved purchasing schedules. The correct audit response is therefore to record the evidence demonstrating controlled management of change and continue with the planned audit trail.

The correct answer is A.

This is a serious attempted bribe and a direct threat to audit integrity, impartiality, and credibility. A third-party auditor must not accept gifts, inducements, or favorable treatment in exchange for changing, hiding, or weakening audit findings. The auditor must act ethically and protect the certification process from improper influence.

The organization has also failed to implement the agreed corrective action, so that failure must be recorded accurately. Any attempt to conceal it would be dishonest and would invalidate the audit outcome. In certification auditing, impartiality and objective evidence are fundamental principles. An offer of discounted personal work in exchange for suppressing an audit finding is unacceptable and must be escalated.

Therefore, the correct response is to:

stop the audit activity, because the integrity of the audit has been compromised;

leave the site;

report the attempted bribe immediately to the individual(s) managing the audit programme or certification body;

avoid further direct contact with the auditee until instructions are given.

Why the other options are wrong:

B is unethical because it ignores both the failed corrective action and the attempted bribe.

C is fraudulent because it involves knowingly recording false audit information and accepting the improper benefit.

D is also unethical because it accepts the benefit indirectly and delays the audit to help the auditee avoid the finding.

ISO 45001:2018 requires a holistic approach to occupational health and safety. This means considering all aspects that could impact worker well-being, not just obvious physical hazards. The correct answer encompasses work activities (the tasks themselves), workplace design (the physical environment), and human factors (psychological and social aspects like working hours and harassment). It ' s the most comprehensive and aligned with the standard ' s philosophy

ISO 45001:2018, Clause 6.1.2, outlines requirements for hazard identification. Hazards to consider include work activities, workplace design, human factors, and social factors that may impact OH and S. These go beyond traditional physical risks and include psychosocial and organizational hazards.

Analysis of Options:

A. Work activities, workplace design, and human factors such as hours of work and bullying and harassment:Correct. This comprehensively addresses hazard categories outlined in ISO 45001, Clause 6.1.2.

B. Work activities where there is the possibility of danger:Too general. ISO 45001 includes broader categories of hazards, including those related to organizational and social factors.

C. Hot-work, working at height, enclosed space entry, and work on electrical equipment:Too narrow. These are specific hazards but do not encompass the full range outlined in ISO 45001.

D. Work hazards and environmental factors such as bad weather:Incomplete. While environmental factors are relevant, ISO 45001 also includes workplace design, human factors, and psychosocial hazards.

ISO References:

Clause 6.1.2.1: Hazard identification.

Annex A.6.1.2: Examples of hazard categories, including workplace design and human factors.

A first-party audit is an internal audit. In ISO management system auditing terminology, first-party audits are performed by, or on behalf of, the organization itself to evaluate its own management system. Therefore, E. Internal audit is directly correct.

A first-party audit can also be carried out as a process audit when the organization audits one of its own processes to determine whether it is planned, implemented, maintained, and effective. Since internal audits under ISO 45001 are planned and conducted over processes, functions, and areas within the OH and S management system, D. Process audit also applies.

Why the other options are not correct:

A. Certification audit is a third-party audit, carried out by a certification body, not a first-party audit.

B. Surveillance audit is also a third-party certification body activity conducted after certification.

C. Regulatory audit is performed by a regulator or authority, not by the organization on itself.

F. External audit does not describe a first-party audit, because first-party audits are internal by definition.

Therefore, the two phrases that apply to a first-party audit are:

D, E

ISO 45001 defines " documented information " as information required to be controlled and maintained by an organization. This can include policies, procedures, records, or other relevant data in any format (Clause 3.19). It encompasses all information used to establish, operate, and demonstrate the effectiveness of the OH and S management system.

Analysis of Options:

A. Any paperwork generated when the system is in operation:Incorrect. This is too narrow and excludes digital or other formats.

B. Any information about the system, or generated by it, held in any format:Correct. This aligns with the ISO 45001 definition in Clause 3.19.

C. Paperwork such as Permits to Work and risk assessments:Incorrect. These are examples of documented information but do not encompass the full scope of the term.

D. The master copies of the documents used to operate the system, held in any format:Incorrect. This definition is limited to master copies, while documented information includes records as well.

ISO References:

Clause 3.19: Definition of documented information.

Clause 7.5: Control of documented information.

The correct answers are B, E, and G.

G is true because ISO 19011 states that a closing meeting should be held to present the audit findings and conclusions. This applies to audits generally, not only third-party audits. (Oshisis)

E is true because ISO 19011 guidance says that for some audit situations the closing meeting may be formal, but in other instances, such as internal audits, the closing meeting can be less formal and may simply consist of communicating the findings and conclusions. That means a first-party closing meeting is commonly less formal than a third-party certification closing meeting. (Synersia Foundation)

B is also true. ISO 19011 and related guidance allow the use of remote methods / ICT in audit activities, and remote audit methods may be combined with on-site methods. From that, it follows that the audit team leader may arrange for audit team members to join activities such as the closing meeting virtually, where appropriate and controlled. This is an inference from the permitted use of ICT in audits. (ISO)

Why the others are false:

A is false because the closing meeting is for presenting findings and conclusions, not for changing findings simply because the auditee is unhappy. Findings can be clarified, but not changed without objective evidence. (Oshisis)

C is false because there is no rule that the audit team must meet formally immediately after the closing meeting to consider recommendations.

D is false because ISO 19011 says some closing meetings may be formal and recorded, but internal audits can be less formal, so they do not always have to be documented in that way. (Synersia Foundation)

F is false because the audit team leader is responsible for managing the audit team and assigning roles.

H is false because the closing meeting should be chaired by the audit team leader, not by the audit client. (Oshisis)

Option D provides the most complete description because audit resources must be adequate for the audit programme and capable of supporting achievement of the audit objectives, with competent personnel being a critical component. Resources are broader than management personnel, technology or a timescale considered individually. Depending on the programme, they may include auditors and technical experts with appropriate competence, sufficient time, financial resources, audit methods and tools, travel arrangements, information and communication technology, and other logistical support. The overriding requirement is that resources collectively allow audits to be conducted effectively and credibly. ISO/IAF guidance on ISO 19011 specifically states that those managing an audit programme should ensure the audit team ' s competence matches the audit scope and objectives and that adequate resources are available for the audits included in the programme.

Clause 10.2 of ISO 45001 pertains to Nonconformity and Corrective Action. Organizations are required to evaluate incidents, investigate their causes, and implement effective corrective actions to prevent recurrence.

Issue Identified:The incidents in the five old shops are related to VOC emissions from outdated equipment, leading to staff and customer health concerns. This indicates inadequate risk management and failure to act on known safety issues.

Analysis of Options:

A. Display an emergency phone number.This is a reactive approach and does not address the root cause of the issue, i.e., VOC emissions. It also does not align with ISO 45001’s emphasis on preventive measures.

B. Evaluate and update the PPE requirements.While PPE is important, relying solely on PPE without addressing the root cause (emission of VOCs) is insufficient. PPE is considered the last line of defense under the hierarchy of controls.

C. Reassess the OH and S risks associated with the laundry process in the five old shops.This option aligns with ISO 45001, Clause 8.1.2, and Clause 10.2, as it emphasizes reassessing risks and taking steps to mitigate them. A thorough risk assessment could lead to interim measures such as process improvements or administrative controls until the equipment is replaced.

D. Review the current safety procedures.While reviewing safety procedures is useful, it does not address the specific nonconformity related to the equipment’s inability to operate safely.

Best Action:Reassessing the risks in the five shops (Option C) ensures a comprehensive review of the hazards posed by outdated equipment, leading to appropriate preventive and corrective actions.

ISO References:

Clause 10.2: Requires identifying and addressing nonconformities to prevent recurrence.

Clause 8.1.2: Emphasizes the hierarchy of controls and risk assessment as a foundation for mitigating hazards.

The two options that give the strongest cause for concern are E and F.

E. The oil on the floor might spread to other areas of the kitchen is a clear OH and S concern because the spilled oil already presents a slip hazard in the work area and could increase the risk further if it spreads. ISO 45001 requires the organization to eliminate hazards and reduce OH and S risks through operational control. A spreading oil spill shows inadequate control of a workplace hazard and poor housekeeping in an active kitchen environment.

F. Fire protection may be inadequate without adjacent safety equipment is also a strong concern. In a kitchen with hot oil, boiling water, and multiple ignition sources, the absence of visible fire extinguishers or fire blankets raises concern about the adequacy of emergency preparedness and operational control. ISO 45001 requires organizations to establish processes for emergency preparedness and response, including provision for relevant emergency equipment where needed.

Why the other options are weaker:

A is speculative and refers to the storeroom, even though the immediate issue is the unsafe condition in the kitchen.

B is an assumption about workload, not objective evidence of a system failure.

C may be true, but impurities in waste oil are not the key OH and S issue identified here.

D focuses on whether cleaning arrangements are documented, but ISO 45001 does not require every control to be a documented procedure; the stronger evidence is the unsafe condition itself.

The best responses are D, E, and G.

D. Insist that the nonconformities must stand since there is clear evidence for them apart from the videos is correct because audit findings and nonconformities must be based on objective evidence. If the evidence supporting the findings exists independently of the videos, then the findings should not be rescinded simply because there is a dispute about how supplementary material was recorded. A problem with auditor conduct or site permission does not automatically invalidate valid audit evidence already obtained.

E. Advise the OHS Manager that they should speak to the supervisor to confirm the situation is also appropriate because the auditor stated that permission had been obtained from a supervisor who was part of the safety team. Before taking action, the audit team leader should verify the facts. This is a reasonable and proportionate response to clarify whether site permission was actually granted.

G. Indicate that he, as audit team leader, will seek approval for the taking of videos by auditors at the opening meetings with management at all audits in the future is appropriate because it addresses the control weakness going forward. Audit teams should be clear about site rules, confidentiality, and permissions for photographs or videos before audit activities begin. This is a constructive preventive action for future audits.

Why the other options are not the best:

A may be premature until the facts are verified.

B assumes misconduct before confirming the facts.

C is incorrect because auditors do not inherently “must” take videos.

F is too severe before the situation is properly established and investigated.

H is inappropriate because the audit team leader should not personally handle or manipulate the auditor’s personal phone.

Conducting the interview virtually is the most appropriate response because it preserves the planned audit activity, enables the General Manager to provide the required evidence and avoids unnecessary disruption to the surveillance audit. Remote audit methods are legitimate when the required information can be accessed effectively and confidentiality, connectivity and other audit risks are appropriately managed. Replacing the General Manager with other managers could prevent the auditor from obtaining evidence specifically associated with that person ' s leadership responsibilities. Delaying only that interview until the following week would leave the current audit incomplete, while postponing the entire audit is disproportionate when a practical remote method is available. ISO guidance expressly recognizes physical and virtual audit locations, and ISO/IEC TS 17012 provides dedicated guidance for remote methods in first-, second- and third-party management-system audits.

The correct answer is D.

ABC states that it has implemented one single OH and S management system for both plants. Once a single management system covers both sites, the certification body has to determine and audit the scope of the management system being operated, not an artificially narrowed commercial scope. IAF MD 1 says a multi-site organization has a single management system, and the certification body must confirm that a single management system is deployed and determine the scope of the management system being operated. It also says the certification document must reflect the scope of certification and the sites/legal entities covered by that multi-site certification. (IAF)

The argument that XYZ is “just a supplier” does not solve the problem. IAF MD 5 makes an important distinction: where an external provider is only a supplier, the certification body audits the organization’s control of the supplied activity, not the performance of the activity itself. But here, XYZ is not outside the management system; ABC has already said both plants are inside one single OHSMS. So XYZ cannot simply be treated as an external supplier for certification-scoping purposes. (IAF)

This is also consistent with the multi-site certification rules that do not allow an organization to exclude covered sites just to avoid certification consequences. IAF MD 1 explicitly says it is not admissible to exclude a problematic site from scope during certification, and the certification documents must show the sites covered by the certified system. While this example is about a “problematic” site, the principle is the same: once the site is part of the single management system, it cannot be carved out simply for convenience or marketing. (IAF)

Therefore, as a third-party auditor, you should not agree to audit only the food plant while ignoring the packaging plant if both are included in the same ISO 45001 management system.

The three correct responses are A, B, and G.

A is correct because ISO 45001 Clause 5.3 requires top management to ensure that the responsibilities and authorities for relevant roles are assigned, communicated and understood at all levels within the organization, and that they are maintained as documented information. So if top management asks whether responsibilities and authorities for relevant roles have to be documented, the correct answer is yes.

B is correct because Clause 5.1 Leadership and commitment requires top management to ensure that the resources needed to establish, implement, maintain and improve the OH and S management system are available. Therefore, the auditor’s “Yes, you do” is correct.

G is correct because Clause 5.1 also requires top management to promote continual improvement. This is stated directly as part of top management leadership and commitment responsibilities under ISO 45001.

Why the others are not correct:

C is incorrect because top management does have to ensure that processes are established for consultation and participation of workers. Clause 5.4 makes this a requirement, so “No, you do not” is wrong.

D is incorrect as written. Top management must establish, implement and maintain the OH and S policy, but ISO 45001 does not state that top management personally has to “write” it. The wording in the option is too specific and not how the standard states the requirement.

E is incorrect because top management does have to ensure that the OH and S management system achieves its intended results. Clause 5.1 says this directly.

F is incorrect because top management must ensure OH and S objectives are established and compatible with the strategic direction, but ISO 45001 does not require top management personally to “write” the objectives.

H is incorrect because the organization must determine the scope under Clause 4.3, and top management remains accountable for the OH and S management system. Saying “No, you do not” is not correct in this context.

The best answer is B.

Under ISO 45001, worker consultation and participation is required by Clause 5.4, but the standard does not require a specific documented procedure for that clause. The organization must provide mechanisms, information, time, training, and resources for consultation and participation, but ISO 45001 does not say it must maintain a formal procedure specifically for this.

Also, ISO 45001 Clause 7.5.3 requires documented information to be controlled so that it is available and suitable for use, and adequately protected. An “obsolete” document is not automatically a nonconformity just because it exists. It may be retained for reference or historical reasons, provided the organization controls it properly and it is not being used unintentionally as current information. That is why the correct audit reaction is to note it and verify on site whether it is actually part of the current controlled documented information.

Why the other options are not the best:

A is weak because using an obsolete procedure to prepare the checklist risks relying on invalid information before confirming what the current controlled version is.

C is unnecessary as the first response. You already have enough evidence to note a potential document-control point and verify it during the audit.

D is incorrect because you should not raise a nonconformity before verifying the facts on site. An obsolete-marked document alone does not prove a breach of Clause 7.5.3. A nonconformity must be based on objective evidence gathered during the audit.

According to ISO 45001:2018, the PDCA cycle is explained in Clause 0.4. The Act phase is defined as: taking actions to improve continually the OH and S performance in order to achieve the intended outcomes. This clearly supports C. Making improvements as a correct answer.

Option D. Resetting objectives is also appropriate because ISO 45001 requires OH and S objectives to be reviewed and updated as appropriate. After checking performance results, the organization may revise or reset objectives as part of continual improvement and corrective action. This aligns with the Act stage, where changes are made to improve system effectiveness and performance.

The remaining options belong to other PDCA phases:

A. Verifying training relates more to evaluation of competence and effectiveness, which fits checking activities.

B. Measuring objectives belongs to the Check phase because ISO 45001 says Check includes monitoring and measurement against OH and S policy and objectives.

E. Providing infrastructure belongs to the Do phase because it is part of providing resources and operational support.

F. Auditing processes belongs to the Check phase because internal audits are part of performance evaluation under Clause 9.2.

Therefore, the correct answer is:

C, D

ISO 45001 requires an organization to determine the external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended results of the OH and S management system. This is established in Clause 4.1 – Understanding the organization and its context. External issues are typically conditions arising outside the organization, such as market conditions, social conditions, legal environment, economic factors, and technological developments. Internal issues are those related to the organization’s people, structure, culture, ownership, competence, and operational arrangements.

D. New technology available on the market is an external issue because it exists in the external business and technological environment. It is not created inside the organization, but it can affect how the organization manages OH and S risks and opportunities, for example by introducing safer equipment, automation, or new control methods. ISO 45001 guidance in Annex A recognizes that technological environment can be part of context analysis.

F. Average salaries in the business sector is also an external issue because it relates to the wider economic and labor-market environment, not the organization’s own internal arrangements. This kind of issue can influence recruitment, retention, competence availability, and worker welfare conditions, all of which may indirectly affect OH and S performance. It is part of the external economic context.

Why the other options are not external:

A. Increased number of outsourced processes is mainly an internal organizational decision about how work is arranged and controlled. Although outsourced providers are external parties, the increase in outsourcing is part of the organization’s internal operating model.

B. New owners of the organisation is an internal issue because ownership and governance are part of the organization’s internal structure and direction.

C. Workers joined a trade union is generally treated as an internal workforce/industrial relations issue, because it directly concerns the organization’s workers and participation arrangements.

E. Recently hired workers with limited command of the local language is an internal issue because it concerns the competence, communication, and workforce characteristics within the organization.

Therefore, the two options related to external issues are:

D, F

In a first-party audit (internal audit), the organization conducts the audit to determine whether its management system conforms to planned arrangements, to the organization’s own requirements, and to the requirements of ISO 45001, and whether it is effectively implemented and maintained. ISO 45001 Clause 9.2 requires internal audits to provide information on conformity and effectiveness.

E. Verify compliance with regulatory requirements is a valid audit objective because ISO 45001 requires the organization to determine its legal and other requirements and to evaluate compliance with them. Internal audits commonly include verification that these legal OH and S obligations are being met as part of checking the effectiveness and conformity of the OH and S management system. This aligns with Clause 6.1.3 and Clause 9.1.2 of ISO 45001.

B. Complete the audit on time is also an audit objective in practical first-party auditing because audit objectives are established for the audit and supported by planning, resources, timing, and reporting arrangements. While it is not a system conformance criterion, it is a valid objective for the audit assignment itself, ensuring the audit is performed as planned and efficiently managed. This fits normal lead auditor practice in planning and conducting internal audits.

Why the other options are not correct:

A. Apply international standards is too broad and is not itself an audit objective. Standards are the criteria or reference, not the objective.

C. Confirm the scope of the management system is accurate is not usually stated as a first-party audit objective; scope is established by the organization under Clause 4.3, though it may be reviewed during audits.

D. Prepare the audit report for the certification body does not apply to a first-party audit, because internal audits are not performed for a certification body.

F. Update the management policy is a management responsibility, not an audit objective. Audits may identify inputs for policy review, but updating the policy is not the purpose of the audit itself.

Therefore, the two correct options are:

B, E

Worker participation is a fundamental principle of ISO 45001 (Clause 5.4). It ensures workers at all levels are involved in key activities to enhance the OH and S management system ' s effectiveness.

Analysis of Options:

A. Determining competence requirements:Incorrect. Determining competence is primarily the responsibility of management, though workers may provide input.

B. Establishing OHS objectives:Correct. Worker involvement ensures objectives are realistic and relevant to workplace conditions (Clause 6.2).

C. Managing internal audit programme:Incorrect. Managing audits is typically a managerial responsibility, though workers may participate in audits.

D. Determining actions to eliminate hazards:Correct. Workers’ insights are critical in identifying and implementing actions to eliminate hazards (Clause 8.1.2).

E. Determining what needs to be communicated:Incorrect. While communication strategies impact workers, their participation in determining communication needs is not explicitly required.

F. Establishing OHS policy:Correct. Workers should be involved in developing policies to ensure relevance and buy-in (Clause 5.2).

ISO References:

Clause 5.4: Worker participation.

Clause 6.2: OHS objectives.

Clause 8.1.2: Hierarchy of controls and hazard elimination.