# OH&S audit trail checklist

Use this when you plan or run an ISO 45001 audit, internal, supplier or certification. For each part of the
occupational health and safety management system it lists what to sample, who to talk to and what
objective evidence to look for, with a column for the legal duty the same evidence often meets. It is a
working aid, not legal advice: the duties shown are from the EU Framework Directive 89/391/EEC and OSHA's
Recommended Practices, and your own national law decides what applies. ISO 45001 is sold rather than
published, so check requirement wording against your own copy of ISO 45001:2018 and its 2024 amendment.

## Before the audit

- [ ] Audit objectives, scope and criteria agreed with whoever commissioned the audit
- [ ] Sites, shifts, processes and contractors inside the scope, with the riskiest named
- [ ] The register of legal requirements and other requirements, received and read
- [ ] Previous audit findings and incident records since the last audit
- [ ] A plan to talk to workers and their representatives, not only managers
- [ ] Safety rules for the auditors themselves on site: induction, PPE, escorts

## On site: what to sample

- [ ] Context and interested parties (clause 4): who the organization says its workers and other interested parties are, and whether contractors and temporary staff are in. Evidence: ________
- [ ] Consultation and participation of workers (clause 5.4): minutes, safety committee records, how a worker raises a concern and what happened to it. Legal link: Directive Art. 11; OSHA Worker Participation. Evidence: ________
- [ ] Hazard identification and risk assessment (clause 6.1.2): assessments for the tasks you watch, dated and reviewed after changes. Legal link: Directive Art. 9(1)(a); OSHA Hazard Identification and Assessment. Evidence: ________
- [ ] Legal and other requirements (clause 6.1.3): the register is current and compliance is evaluated. Evidence: ________
- [ ] Competence and awareness (clause 7): training records for the people you interviewed, on recruitment and on change of job. Legal link: Directive Art. 12; OSHA Education and Training. Evidence: ________
- [ ] Operational controls (clause 8): controls chosen in the order of the hierarchy of controls, elimination first. Legal link: Directive Art. 6(2) principles of prevention; OSHA Hazard Prevention and Control. Evidence: ________
- [ ] Contractors and procurement (clause 8): how contractor risks are assessed and controlled on site. Legal link: OSHA Communication and Coordination for Host Employers, Contractors, and Staffing Agencies. Evidence: ________
- [ ] Emergency preparedness (clause 8): drills held, results recorded, actions closed. Legal link: Directive Art. 8. Evidence: ________
- [ ] Internal audit (clause 9.2) and management review (clause 9.3): program, reports and the decisions taken. Legal link: OSHA Program Evaluation and Improvement; Management Leadership. Evidence: ________
- [ ] Incidents, nonconformities and corrective action (clause 10.2): investigations that reach root cause, with workers involved. Legal link: Directive Art. 9(1)(c) list of accidents. Evidence: ________

## Writing findings

- [ ] Every nonconformity names the requirement, the evidence and why the evidence does not meet it
- [ ] Nothing reported on a manager's assurance alone
- [ ] Findings that put people at immediate risk raised on the day, not saved for the report

Sources: ISO 45001:2018 (https://www.iso.org/standard/45001); ISO 19011:2026
(https://www.iso.org/standard/19011); Council Directive 89/391/EEC (http://data.europa.eu/eli/dir/1989/391/oj);
OSHA Recommended Practices for Safety and Health Programs (https://www.osha.gov/safety-management).
Read 20 October 2026. From Credential Press, credentialpress.com.