ISO 45001
Who audits health and safety systems to ISO 45001, and which exam will you sit?
An occupational health and safety audit is not a walk round with a clipboard. The auditor is there to find out whether a management system actually keeps people from being hurt or made ill at work, and to say so with evidence an organization cannot argue with. The ISO 45001 Lead Auditor is the person trusted to plan that audit, lead the team and stand behind the report. This guide is about who that person tends to be, what they sample on site, and which of PECB's two exams they are likely to sit.
The facts here come from ISO's pages for ISO 45001 and ISO 19011, PECB's two ISO 45001 Lead Auditor Candidate Handbooks, the essay edition, version 2.1, and the multiple-choice edition, version 1.5, PECB's course page, the EU Framework Directive 89/391/EEC, OSHA's Recommended Practices for Safety and Health Programs and the O*NET profile for occupational health and safety specialists, all read on 20 October 2026.
What does an ISO 45001 Lead Auditor audit?
An occupational health and safety management system, or OH&S management system. ISO 45001:2018 sets the requirements for one. It is the first edition, published in March 2018 by ISO's technical committee ISO/TC 283, and it has been amended once, by ISO 45001:2018/Amd 1:2024. On the day we read it, ISO's page listed the standard as due for revision and said it is expected to be replaced by a new edition, now a draft international standard, within the coming months. Until then, the 2018 text with its amendment is the one auditors audit against.
The standard follows the same clause structure as ISO 9001 and ISO 14001, but its content is about people. It asks an organization to understand who its workers are, including contractors and temporary staff, to consult them and involve them, to identify hazards and assess the risks, to know the legal requirements that apply, and to control risks in a set order, starting with eliminating the hazard. It then asks the organization to monitor how it is doing, investigate incidents, audit itself, review the system at the top and improve.
The auditor's job is to test all of that against evidence. How audits should be run is set out in ISO 19011, the guidelines for auditing management systems, whose fourth edition, ISO 19011:2026, was published in May 2026 and replaced the 2018 edition. Certification bodies that audit for certification work to ISO/IEC 17021-1, the requirements for bodies that audit and certify management systems.
PECB's seven competency domains are the same on both exam papers, but the weights are not:
| Domain | Essay: questions | Essay: points | Multiple-choice: questions |
|---|---|---|---|
| 1. Fundamental principles and concepts of an OH&S management system | 2 | 10 (13.3%) | 9 (11.25%) |
| 2. OH&S management system and ISO 45001 requirements | 2 | 10 (13.3%) | 10 (12.5%) |
| 3. Fundamental audit concepts and principles | 2 | 10 (13.3%) | 15 (18.75%) |
| 4. Preparing an ISO 45001 audit | 1 | 10 (13.3%) | 10 (12.5%) |
| 5. Conducting an ISO 45001 audit | 3 | 20 (26.7%) | 16 (20%) |
| 6. Closing an ISO 45001 audit | 1 | 5 (6.7%) | 10 (12.5%) |
| 7. Managing an ISO 45001 audit program | 1 | 10 (13.3%) | 10 (12.5%) |
| Total | 12 | 75 | 80 |
Conducting the audit carries the most weight on both papers, which matches the job: most of an auditor's skill is in gathering evidence on site and judging what it shows. The difference is in the rest. The multiple-choice paper gives audit concepts and principles 15 questions, almost a fifth of the paper, while the essay paper spreads its points more evenly and gives the closing meeting and report only five.
Essay or multiple-choice: which exam will you sit?
PECB publishes two Candidate Handbooks for the same credential, and both were on PECB's site when we checked. The essay handbook, version 2.1, sets 12 essay-type questions worth 75 points in all. PECB says essay questions are used to judge whether a candidate can answer clearly, and that problem-solving and arguments supported with reasoning and evidence are also marked. Eight of the 12 questions test comprehension, application and analysis, and four test evaluation.
The multiple-choice handbook, version 1.5, sets 80 questions with three options each, one right and two wrong. It mixes stand-alone questions with scenario-based ones, where you read one scenario and answer five questions about it. Here 34 questions test comprehension, application and analysis, and 46 test evaluation. Both papers pass at 70%, and both are open book.
The direction of travel is clear. The essay handbook carries a note that PECB will progressively transition to multiple-choice exams, which will also be open book and use scenario-based questions to test whether you can apply, analyze and justify a decision. PECB's list of exams, read on 5 October 2026, gives the English exam as multiple choice: 80 questions in three hours, open book. The essay handbook is still published, so if your course runs in another language or on the earlier format, ask your training partner which paper you will sit. The domains are the same, and so is the job, but the skills differ: an essay rewards structured written argument, and a multiple-choice paper rewards fast, careful reading of a scenario and a sharp eye for the option that is nearly right.
Who gets sent on the course?
PECB's audience list for the five-day course names auditors who want to perform and lead OH&S management system certification audits, managers or consultants who want to deepen their knowledge of the OH&S audit process, internal auditors and people responsible for keeping an organization conforming to ISO 45001, technical experts preparing for an OH&S audit, and expert advisers in occupational health and safety management. PECB says participants need a fundamental understanding of ISO 45001 and a thorough knowledge of audit principles.
In the United States, O*NET's profile for occupational health and safety specialists describes people who review, evaluate and analyze work environments and design programs and procedures to control, eliminate and prevent disease or injury, and who may conduct inspections and enforce adherence to the law. Its reported job titles include EHS officer, health and safety analyst, OHS consultant, risk control consultant and safety specialist. O*NET places the occupation in Job Zone Four, which calls for considerable preparation, usually a bachelor's degree. Put job titles on PECB's list and a familiar cast appears.
| Role | Why the audit work lands on them | What they need from the credential |
|---|---|---|
| Certification body auditor | Auditing to ISO 45001 is the job | A recognized credential and the method a certification audit follows |
| Internal auditor | The standard requires internal audits at planned intervals | How to plan a program, sample fairly and write findings that stand up |
| Health and safety manager | They own the system and are asked to check it, or a sister site | The auditor's view of their own system, before the certification body arrives |
| Supplier or contractor auditor | Major clients audit the safety systems of the contractors they hire | A defensible way to judge a supplier's system on a short visit |
| Consultant | Clients want a mock audit before certification | Credibility, and the discipline to report what the evidence shows |
| Quality or environmental auditor | Their employer runs an integrated system and wants one audit team | The OH&S-specific requirements, especially worker participation |
The common thread is independence. An OH&S auditor will often be told, kindly, that something is fine. The credential exists to give them the method and the confidence to say "show me", and to report what they found even when it is uncomfortable. In health and safety, the uncomfortable finding is usually the one that matters.
When does the work land on your desk?
Your organization is certifying
Before a certification body arrives, someone has to run the internal audits that ISO 45001 requires and give management an honest view of the gaps. Often that person is a health and safety manager or an internal auditor from quality or environment, and the course is how they learn to audit the OH&S system to the same standard.
A client audits its contractors
Picture a construction or energy company that hires dozens of contractors on every project. Its contracts require each contractor to run a safety management system, and someone has to check that the systems are real. That someone needs to be able to judge a contractor's system in a day, find the evidence that matters and write a report the contractor cannot dismiss.
You want to audit for a certification body
Some candidates come to the course because they want to become third-party auditors. For them, the credential is a step toward the competence a certification body will expect, and the audit hours they log move them up PECB's levels.
Something has gone wrong
After a serious incident, a board often wants an independent look at whether the system that should have prevented it actually works. That audit tends to be the most demanding one an OH&S auditor ever leads, because every finding will be read by people who are looking for someone to blame.
What an OH&S auditor samples, and the law it touches
This is the table that saves the most time when you plan your first ISO 45001 audit. It takes the parts of the system an auditor samples most often, says what objective evidence to look for, and shows the legal duty the same evidence often meets: in the EU, the Framework Directive 89/391/EEC, which national laws transpose; in the United States, the core elements of OSHA's Recommended Practices for Safety and Health Programs. The last column shows where PECB tests the skill. The legal columns are our mapping of where the evidence overlaps, not legal advice.
| ISO 45001 area | What the auditor samples | EU Directive 89/391/EEC | OSHA core element | PECB domain |
|---|---|---|---|---|
| 5.4 Consultation and participation of workers | Committee minutes, how a worker raises a concern and what happened to it, interviews with workers | Art. 11, consultation and participation of workers | Worker Participation | 2 and 5 |
| 6.1.2 Hazard identification and risk assessment | Assessments for the tasks you watch, dated, reviewed after changes | Art. 9(1)(a), a risk assessment the employer holds | Hazard Identification and Assessment | 2 and 5 |
| 6.1.3 Legal and other requirements | The register, kept current, and the evaluation of compliance | The national laws that transpose the Directive | The OSHA standards that apply | 2 and 5 |
| Clause 7: competence and awareness | Training records for the people you interviewed, on recruitment and on change of job | Art. 12, training of workers | Education and Training | 5 |
| Clause 8: hierarchy of controls | Controls chosen in order, elimination first, personal protective equipment last | Art. 6(2), the general principles of prevention | Hazard Prevention and Control | 5 |
| Clause 8: contractors and procurement | How contractor risks are assessed and controlled on site | Art. 6 general obligations on the employer | Communication and Coordination for Host Employers, Contractors, and Staffing Agencies | 5 |
| Clause 8: emergency preparedness | Drills held, results recorded, actions closed | Art. 8, first aid, fire-fighting and evacuation | Hazard Prevention and Control | 5 |
| 9.2 Internal audit and 9.3 management review | The program, the reports and the decisions taken at the top | Art. 6(1), adjust measures and improve | Program Evaluation and Improvement; Management Leadership | 5 and 7 |
| 10.2 Incidents, nonconformities and corrective action | Investigations that reach a root cause, with workers involved | Art. 9(1)(c), a list of accidents keeping a worker off for more than three working days | Program Evaluation and Improvement | 5 and 6 |
Two things stand out. First, the same evidence answers the standard and the law. The worker who was consulted, the risk assessment that was reviewed, the training record from a change of job: an auditor who samples them well is testing conformity and, in passing, the legal basics. Second, almost every row ends up in PECB's conducting domain, the heaviest on both papers. The exam is weighted toward the moment on site when the auditor has to decide whether the evidence in front of them is enough. We have turned the table into a checklist you can copy below.
OH&S audit trail checklist
OH&S audit trail checklist
Use this when you plan or run an ISO 45001 audit, internal, supplier or certification. For each part of the occupational health and safety management system it lists what to sample, who to talk to and what objective evidence to look for, with a column for the legal duty the same evidence often meets. It is a working aid, not legal advice: the duties shown are from the EU Framework Directive 89/391/EEC and OSHA's Recommended Practices, and your own national law decides what applies. ISO 45001 is sold rather than published, so check requirement wording against your own copy of ISO 45001:2018 and its 2024 amendment.
Before the audit
- Audit objectives, scope and criteria agreed with whoever commissioned the audit
- Sites, shifts, processes and contractors inside the scope, with the riskiest named
- The register of legal requirements and other requirements, received and read
- Previous audit findings and incident records since the last audit
- A plan to talk to workers and their representatives, not only managers
- Safety rules for the auditors themselves on site: induction, PPE, escorts
On site: what to sample
- Context and interested parties (clause 4): who the organization says its workers and other interested parties are, and whether contractors and temporary staff are in. Evidence: ________
- Consultation and participation of workers (clause 5.4): minutes, safety committee records, how a worker raises a concern and what happened to it. Legal link: Directive Art. 11; OSHA Worker Participation. Evidence: ________
- Hazard identification and risk assessment (clause 6.1.2): assessments for the tasks you watch, dated and reviewed after changes. Legal link: Directive Art. 9(1)(a); OSHA Hazard Identification and Assessment. Evidence: ________
- Legal and other requirements (clause 6.1.3): the register is current and compliance is evaluated. Evidence: ________
- Competence and awareness (clause 7): training records for the people you interviewed, on recruitment and on change of job. Legal link: Directive Art. 12; OSHA Education and Training. Evidence: ________
- Operational controls (clause 8): controls chosen in the order of the hierarchy of controls, elimination first. Legal link: Directive Art. 6(2) principles of prevention; OSHA Hazard Prevention and Control. Evidence: ________
- Contractors and procurement (clause 8): how contractor risks are assessed and controlled on site. Legal link: OSHA Communication and Coordination for Host Employers, Contractors, and Staffing Agencies. Evidence: ________
- Emergency preparedness (clause 8): drills held, results recorded, actions closed. Legal link: Directive Art. 8. Evidence: ________
- Internal audit (clause 9.2) and management review (clause 9.3): program, reports and the decisions taken. Legal link: OSHA Program Evaluation and Improvement; Management Leadership. Evidence: ________
- Incidents, nonconformities and corrective action (clause 10.2): investigations that reach root cause, with workers involved. Legal link: Directive Art. 9(1)(c) list of accidents. Evidence: ________
Writing findings
- Every nonconformity names the requirement, the evidence and why the evidence does not meet it
- Nothing reported on a manager's assurance alone
- Findings that put people at immediate risk raised on the day, not saved for the report
Sources: ISO 45001:2018 (https://www.iso.org/standard/45001); ISO 19011:2026 (https://www.iso.org/standard/19011); Council Directive 89/391/EEC (http://data.europa.eu/eli/dir/1989/391/oj); OSHA Recommended Practices for Safety and Health Programs (https://www.osha.gov/safety-management). Read 20 October 2026. From Credential Press, credentialpress.com.
Where does the credential apply?
ISO 45001 is an international standard, and certification to it is offered by certification bodies in many countries. PECB runs its exams worldwide, online through the PECB Exams application with a remote invigilator, or on paper through the partner that ran your course. Candidates who sit a Lead exam in a language that is not their own can ask, on the day, for 30 extra minutes. PECB says results for essay exams take three to eight weeks, while online multiple-choice results arrive instantly.
The law around the standard varies. In the EU, Directive 89/391/EEC sets the framework that national health and safety laws build on. In the United States, OSHA enforces its standards and publishes its Recommended Practices, whose seven core elements map closely onto a management system. In Great Britain, the Health and Safety Executive's guide Managing for health and safety (HSG65) explains the Plan, Do, Check, Act approach that ISO 45001 also uses. An auditor who knows the local law reads the evidence better, but the audit itself is against the standard.
What the credential is not
It is not a certificate for your organization. The Lead Auditor is a personal credential. An organization is certified to ISO 45001 by a certification body after an audit.
It is not a safety inspector's license. A management system audit asks whether the system works, using samples of evidence. It does not replace the legal inspections, examinations and permits that health and safety law requires, and an auditor who finds a serious hazard on site should raise it at once, not save it for the report.
It is not the implementer's credential. PECB runs a separate ISO 45001 Lead Implementer scheme for people who build the system. Our guides to the ISO 45001 Lead Auditor interview questions and which certification suits which role help if you are choosing.
And it is not a substitute for the standard. ISO 45001 is sold rather than published free. Both papers are open book: PECB allows a hard copy of ISO 45001, the training course materials and your own course notes, and the essay handbook adds a hard copy dictionary. Our guide to PECB's open-book rules explains what that does and does not let you do.
Which credential level can you claim?
PECB awards four levels on the same exam. You sit one paper; the title you hold depends on the experience and audit hours you can show.
| Credential | Work experience | OH&S management experience | Audit activities |
|---|---|---|---|
| Provisional Auditor | None | None | None |
| Auditor | Two years | One year | 200 hours |
| Lead Auditor | Five years | Two years | 300 hours |
| Senior Lead Auditor | Ten years | Seven years | 1,000 hours |
Each level also needs the exam and a signed PECB Code of Ethics. The handbook lists the audit work that counts, including planning an audit, managing an audit program, drafting audit reports, nonconformity reports and working documents, reviewing documented information, conducting on-site audits and following up on nonconformities. PECB certifications are valid for three years. If you are early in your career, the Provisional Auditor shows you passed the same exam, and the hours from your first audits move you up.
How does it compare with the credentials around it?
| PECB ISO 45001 Lead Auditor | PECB ISO 45001 Lead Implementer | PECB ISO 14001 Lead Auditor | |
|---|---|---|---|
| The question it answers | Can you plan and lead an audit of an OH&S management system? | Can you build and run one? | Can you plan and lead an audit of an environmental management system? |
| Anchored in | ISO 45001:2018 and audit practice | ISO 45001:2018 | ISO 14001 and audit practice |
| Best fit | Certification body, internal and supplier auditors | Health and safety managers, consultants | Environmental and integrated-system auditors |
| Natural pairing | ISO 14001 Lead Auditor, for an integrated audit team | ISO 45001 Lead Auditor | ISO 45001 Lead Auditor |
The audit method is shared across PECB's lead auditor schemes, which is why many auditors hold two or three. Health and safety and environment pair especially well, because the two standards share a structure and many organizations audit them together. If that is your route, the ISO 14001 Lead Auditor Exam Guide covers the environmental side.
What will the exam expect of you?
On the essay paper, you write. Each question gives you a situation and asks what the auditor should do, why, and with what evidence, and marks go to structure and justification as much as to the right conclusion. On the multiple-choice paper, you read scenarios and choose between three options that are often all reasonable. Either way, the same weak answers lose marks.
They are rarely absurd. They describe sensible things done in the wrong order or on the wrong evidence: accepting a manager's assurance that workers were consulted without talking to any workers, raising a nonconformity against a requirement the standard does not contain, auditing a procedure you helped write, or treating a missing signature as a major nonconformity when the control itself works. Our guide to PECB scenario-based questions shows the multiple-choice pattern. On the essay paper, practice writing against the clock: plan each answer in a few lines, name the requirement, the evidence and the conclusion, and stop.
If you fail, PECB emails a list of the domains where you did poorly, and there is no limit on retakes, though PECB sets minimum gaps between attempts. PECB's course page adds that you can retake the exam within 12 months free of charge. Our guide to PECB results and retakes has the detail.
How to prepare
Most candidates sit the exam on day five of a PECB partner course. The four teaching days cover an introduction to OH&S management systems and ISO 45001, audit principles and the preparation for and start of an audit, on-site audit activities, and closing the audit. PECB's course page says the certification and exam fees are included in the course price, that participants receive over 450 pages of instructional materials, and that the course earns a participation certificate worth 31 CPD credits.
The ISO 45001 Lead Auditor Exam Guide (Wikidata) has 14 chapters across PECB's seven domains, written for the essay paper. Each chapter sets out what the domain asks of you, the confusable pairs that cost marks, the trap in the material, how to answer in an essay and five questions to ask yourself. The ISO 45001 Lead Auditor Practice Exams (Wikidata) gives you three complete practice papers at the essay paper's point allocation, with model answers and marking schemes.
Both books are written for PECB's essay paper, Candidate Handbook version 2.1, and ISO 45001:2018 with its 2024 amendment. If your course uses the multiple-choice paper, Candidate Handbook version 1.5, the seven domains are the same but the weights differ, as the table above shows. ISO expects to replace ISO 45001:2018 with a new edition within the coming months, so check the standard's page and the newest handbook before relying on any book, ours included.
So, should it be you?
It probably should if, in the next year, you will run internal audits of an OH&S management system, audit contractors or suppliers, prepare an organization for its certification audit, or start work toward auditing for a certification body. It is a particularly good fit if you already audit quality or environmental systems and your employer wants one team to cover all three.
It probably should not, or not yet, if you will build the system rather than audit it, in which case the Lead Implementer serves you better, or if your work is mainly technical safety inspection, where the law in your country sets its own qualifications.
The best OH&S auditors share one habit, and it is the habit both papers reward: they go and look, they talk to the people doing the work, and they write down only what the evidence shows. If that already describes how you work, the credential is a short step. If it describes how you would like to work, it is a very good one.
Questions people ask about the ISO 45001 Lead Auditor
Who is the ISO 45001 Lead Auditor certification for?
People who audit occupational health and safety management systems. PECB's course page names auditors who want to perform and lead OH&S certification audits, managers and consultants who want to know the audit process, internal auditors and people responsible for ISO 45001 conformity, technical experts preparing for an audit, and expert advisers in occupational health and safety management.
Is the PECB ISO 45001 Lead Auditor exam essay or multiple-choice?
PECB publishes both. The essay handbook, version 2.1, sets 12 questions worth 75 points; the multiple-choice handbook, version 1.5, sets 80 questions with three options each. Both pass at 70%, and the essay handbook says PECB will progressively move to multiple-choice exams. PECB's list of exams already gives the English exam as multiple choice, 80 questions in three hours.
What experience do I need for the full ISO 45001 Lead Auditor credential?
PECB asks for five years of work experience, two of them in occupational health and safety management, and 300 hours of audit activities, plus the exam and the PECB Code of Ethics. With the exam alone you can hold the Provisional Auditor credential and move up later.
Which edition of ISO 45001 does the exam follow?
ISO 45001:2018, the first edition, published in March 2018, with Amendment 1 published in 2024. ISO's page says it is expected to be replaced by a new edition, now at the draft international standard stage, within the coming months. Check the standard's page and your handbook before you sit.
Can I bring the standard into the ISO 45001 exam?
Yes, both papers are open book. PECB allows a hard copy of ISO 45001, the training course materials and the notes you took during the course. The essay handbook also allows a hard copy dictionary. ISO 45001 is sold rather than published, so you need your own copy.
Does ISO 45001 replace health and safety law?
No. ISO 45001 is a management system standard, and an organization still has to meet the law where it operates, such as the EU Framework Directive 89/391/EEC as transposed into national law, or OSHA rules in the United States. The standard asks the organization to identify those legal requirements and evaluate its compliance with them.
ISO 45001 Lead Auditor or Lead Implementer: which first?
Pick the side of the table you will sit on. The auditor plans and runs audits of an OH&S management system and reports what the evidence shows; the implementer builds the system. People heading for internal audit, supplier audit or a certification body usually start with Lead Auditor.
Which domain carries the most marks?
Conducting an ISO 45001 audit, on both papers: 20 of 75 points on the essay paper and 16 of 80 questions on the multiple-choice paper. Audit concepts and principles carry 15 of the 80 multiple-choice questions.
What happens if I fail the PECB exam?
PECB emails a list of the domains where you did poorly, and there is no limit to the number of retakes, though PECB sets minimum gaps between attempts. PECB's course page says that if you fail you can retake the exam within 12 months free of charge.
How long is the certification valid?
PECB certifications are valid for three years. To keep them, certified professionals meet PECB's maintenance requirements for the credential they hold.
ISO 45001 Lead Auditor: test yourself in five minutes
Which books prepare you for the ISO 45001 Lead Auditor exam?
ISO 45001 Lead Auditor Exam Guide
A study companion for the PECB Certified ISO 45001 Lead Auditor examination. 14 chapters, 402 pages.
ISO 45001 Lead Auditor Practice Exams
Three complete practice papers with model answers and marking schemes. 89 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- ISO, ISO 45001:2018, edition 1, published March 2018, ISO/TC 283; Amd 1:2024; listed as to be revised
- ISO, ISO 19011:2026, Guidelines for auditing management systems, edition 4, published May 2026
- ISO, ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems
- PECB, ISO 45001 Lead Auditor Candidate Handbook, essay exam, version 2.1
- PECB, ISO 45001 Lead Auditor Candidate Handbook, multiple-choice exam, version 1.5
- PECB, ISO 45001 Lead Auditor course: audience, prerequisites, agenda, fees, materials and retakes
- Council Directive 89/391/EEC on the introduction of measures to encourage improvements in the safety and health of workers at work, Articles 6, 8, 9, 11 and 12
- OSHA, Recommended Practices for Safety and Health Programs: core elements
- HSE, Managing for health and safety (HSG65), 2013
- O*NET OnLine, 19-5011.00 Occupational Health and Safety Specialists
Credential Press is not affiliated with, endorsed by or authorized by PECB or ISO. Exam names and trademarks belong to their owners.