ISO 45001 Checklist 2026: Audit Requirements, Steps & Key Points

One fine day you opened your inbox. 

You saw an opportunity, new client, good contract, the kind your sales team has been chasing for months. You open the requirements document. Halfway down the page, one line stops everything.

"Suppliers must hold a valid ISO 45001 certification."

You do not have it. You have a safety policy somewhere. You have a toolbox talk template from three years ago. You have good intentions and a team that genuinely cares about not getting people hurt. But you do not have a certified, auditable Occupational Health and Safety Management System.

So you do what most managers do. You call around, get a quote from a consultant, and ask how fast this thing moves. The answer is not what you were hoping for. The certification journey typically takes six to twelve months, depending on your organization's size and how mature your existing safety practices are. The tender closes in eight weeks.

That is the moment most founders realize the gap between "we take safety seriously" and "we have a documented, clause-compliant OHSMS" is wider than they thought. And the checklist is where that gap shows up first.

The ILO's work-related accidents report puts global non-fatal workplace injuries somewhere around 374 million per year. The standard exists because those numbers are preventable. Your certification exists to prove your system is actually preventing them, not just intending to.

This is a clause-by-clause walkthrough of the full ISO 45001 audit checklist. By the end of it, you will know what auditors look for at each stage, which documents they expect to see, and where most businesses leave gaps without realizing it, and how you can leverage  ISO 45001 software from the start to keep your system organized long before the pressure arrives.

Get this right and the benefits of ISO 45001 certification go beyond the certificate: you get fewer incidents, lower costs, and a compliance record that holds up whether a client asks or an auditor walks in. 

What is an ISO 45001 checklist?

An ISO 45001 checklist is a structured audit tool for your ISO standard. It takes each requirement of the ISO 45001:2018 standard and turns it into a specific, verifiable question. Certification bodies use it. Internal auditors use it. Organizations preparing for their first audit use it to find out how ready they actually are versus how ready they think they are.

The checklist applies to clauses 4 through 10. Clauses 1, 2, and 3 of the standard cover scope, normative references, and definitions. They are informational. No auditor scores you on them.

One thing worth knowing before you start: a "yes" answer without supporting evidence carries no weight in a certification audit. A completed checklist is a starting point. The documents and records behind it are what the auditor actually verifies.

Why your organization needs this checklist in 2026

The implementation of ISO 45001 certification grew 37% globally in the two years ending 2024, based on the 2024 ISO Survey from the International Accreditation Forum.

More organizations are certified now than at any point since the standard launched in 2018. That growth matters because auditor expectations rise with adoption.

An NSC's workplace safety report published by Psico Smart shows us that workplaces with regular safety audits reduce incidents by 30%. Worth noting that this is an operational result, not a compliance formality.

Running this checklist before your audit does three things:

• It finds nonconformities before your certification body does.
  
  
• It gives your internal auditors a consistent evaluation framework.
  
  
• It builds documented proof that your OHSMS runs as a real system, not a set of policies that exist on paper and nowhere else.

ISO 45001 audit checklist: clause-by-clause breakdown

The ISO 45001 clauses show us that there are a total of 10 clauses that are written. However, you should keep in mind that Clauses 1-3 are more towards an introduction, and Clauses 4-10 are practical and need to be studied and implemented, which will impact your business.

Clause 4: Context of the organization

This clause sets the foundation. Auditors want to see that your business understood its environment before designing any safety controls. The logic being you cannot manage risks you have not identified, and you cannot identify them without first understanding the context you operate in.

Ask yourself these questions.

• Have you identified the internal and external issues that affect OH&S outcomes?
  
  
• Have you documented what workers, contractors, regulators, and other interested parties need from your OHSMS?
  
  
• Is the scope of your OHSMS written, approved, and accessible to anyone who needs it?
  
  
• Does your OHSMS documentation reflect how your organization actually operates, not a generic template bought off a shelf?

Auditors typically look for a written scope document, a context analysis that names real internal factors like shift patterns and contractor use alongside external factors like local regulations and industry-specific risks, and meeting records or risk registers that show these inputs actually shaped the system design.

Clause 5: Leadership and worker participation

This clause gets more attention at Stage 2 than most teams expect. Passive management commitment, the kind where a policy is signed but leadership has no active role in the OHSMS, is one of the most consistent nonconformity triggers in certification audits.

Questions to confirm

• Does top management demonstrate visible, documented commitment to the OHSMS?
  
  
• Is there a signed, dated, and communicated OH&S policy?
  
  
• Are roles, responsibilities, and authorities assigned in writing and known to the people holding them?
  
  
• Do workers at all levels participate in hazard identification, risk assessment, and incident reporting?
  
  
• Is there a documented consultation process with records of worker input?

The auditor wants to see a policy signed by a top executive, not a generic management signature. Records of safety meetings where workers contributed to actual decisions. You should have your documents ready like who trained for what and , and they should show which employee is tasked with OHSMS and which employee takes over should they be absent.

A training management system maps those role assignments directly to training requirements so nothing gets missed when the auditor asks.

Clause 6: Planning

Planning is where your OHSMS proves it is proactive. Auditors want evidence that hazard identification is ongoing, not something done once in preparation for the last certification cycle.

Questions to confirm

• Is there an ongoing, documented hazard identification process with a review history?
  
  
• In your risk assessment, do you mention what you are planning to do to improve workers' safety?
  
  
• Have you identified all applicable legal and regulatory requirements?
  
  
• Are OH&S objectives measurable and connected to specific action plans?
  
  
• Do those plans name owners, deadlines, and methods for confirming results?

The most common gaps auditors find here: a legal register that has not been reviewed since the last audit, hazard registers with no dates or revision history, and objectives written so broadly they cannot be measured. "Improve safety culture" is not an objective. "Reduce recordable incidents by 15% by Q3" is a goal.

Clause 7: Support

This clause covers the resources the OHSMS depends on. The resources that you need to mention are:

• How many workers you got in your business and their safety
  
  
• The infrastructure of your business
  
  
• The documentation with whatever has been reported
  
  
• How you and your team communicate with each other

No matter how well your other clauses are documented, if you mess this up, the system will not function; it is as simple as that.

Questions to confirm

• Do you have your workers, your infrastructure, and all your financial findings documented as per OHSMS?
  
  
• Do your workers have the relevant tasks assigned to them, and have they been provided the necessary training?
  
  
• Do you have your internal and external process documented for the OH&S communication?
  
  
• Do all your documents have everything recorded to the T?

You have to question all these because the auditor won’t be casual about this; they will want proof that your team training is relevant to their tasks and it is not something generic. A document control log showing version history and named approvers. Evidence that communication processes reached the right people at the right time, not just that a communication process exists.

Audit management software covers what document control and training tracking look like in a compliance-ready system.

Clause 8: Operation

The largest clause in the standard. This covers everything your organization does to control risk on a working day, including how you manage contractors and what happens when something goes wrong unexpectedly.

Questions to confirm

• Are operational controls documented and active for all significant hazards?
  
  
• Does your hierarchy of controls work through elimination, substitution, engineering controls, administrative controls, and PPE in that order?
  
  
• Are contractor and supplier OH&S requirements defined in procurement processes?
  
  
• Is there a documented emergency preparedness and response plan?
  
  
• Has that plan been tested and reviewed within the past 12 months?
  
  
• Do you have management-of-change processes in place for new processes, new equipment, or personnel changes?

What auditors actually look for here: signed contractor safety agreements, emergency drill records with dates and outcomes, and evidence that the hierarchy of controls was applied rather than PPE being the first and only line of defense.

Clause 9: Performance evaluation

Your OHSMS has to measure itself. This clause confirms that monitoring, internal audits, and management reviews happen at defined intervals rather than when someone has time.

Confirm these questions

• Are your OH&S metrics properly defined in an articulate manner?
  
  
• Are you conducting internal audits? If yes, how often do you do it? What do you document?
  
  
• Are internal auditors trained and independent of the areas they audit?
  
  
• Has a management review taken place in the past 12 months?
  
  
• Do the management review records show that findings led to real decisions?

The completed internal audit report is one of the first documents auditors ask for. Management review minutes that show leadership engaged with data rather than signing off on a pre-written document carry significantly more weight than those that do not.

Managing audit findings, corrective actions, and management review records in separate spreadsheets?

P3 LogiQ links every finding to an action and every action to a review record.

Sign up with P3 LogiQ or book a free demo with us.

Clause 10: Improvement

This is the clause that confirms your OHSMS learns from what goes wrong. It closes the Plan-Do-Check-Act loop. An organization that fixes nonconformities but never changes the underlying process has not met this clause's intent.

Questions to confirm

• Is there a documented process for reporting and investigating incidents and near misses?
  
  
• Are root causes identified and addressed through formal corrective actions?
  
  
• Are corrective actions tracked to closure with documented effectiveness reviews?
  
  
• Is there evidence of improvement beyond simply addressing what went wrong?

Auditors look for incident investigation reports that go past "worker error" as a root cause, a corrective action management register with open dates, closure dates, and effectiveness check notes, and evidence that a procedure actually changed as a result of a lesson learned.

Step-by-step: how to use this checklist for your ISO 45001 certification

Do follow these steps to ensure that you utilize this as per your ISO 45001 checklist.

Step 1: Run a gap analysis first

Work through each checklist item. Log every "no" or "partial" as a gap. That list becomes your pre-certification work plan. Resist the urge to skip the gaps that seem minor at this stage. Minor gaps become major nonconformities when they sit in Clause 6 or Clause 9.

Step 2: Go to the heavy clauses

Clauses 5, 6, 8, and 9 get the most attention in a Stage 2 audit. Address those gaps before working on Clause 7 administrative items, which take less time to close.

Step 3: Assign an owner for every gap

An action item with no owner is an action item that will not get done. Every gap gets a person assigned and a close-out date. Run it like a corrective action register, because it is.

Step 4: Internal audit with independent auditors

Use this checklist as your internal audit tool. Auditors must be independent of the areas they assess. This is not optional. Record every finding, conforming and nonconforming. Clause 9 requires documented internal audit results regardless of what you find.

Step 5: Management review before the certification date

Present internal audit results to top management and record the review. Your certification body will ask for it at Stage 2. A review that happened after you received the audit notification date raises questions.

Step 6: Stage 1 documentation review

Your certification body reviews documentation and confirms whether you are ready to proceed to Stage 2. Gaps found here give you a window to close them. Use that time to confirm corrective actions are evidenced, not just written into a plan.

Step 7: Stage 2 on-site assessment

Auditors interview workers, observe operations, and review records on site. Have your gap analysis, internal audit report, and management review minutes ready. If you have to search for a document during the audit, that is already a signal.

There are businesses that manage quality alongside safety; they use the ISO 9001 checklist and requirements to get certified, which covers the same audit stages from a quality management angle. The overlap is worth reviewing before your Stage 2 date.

Key documents your auditor will request

Missing documentation on audit day pushes certification back by weeks. Prepare these well before the assessment date.

The mandatory documented information under ISO 45001:2018:

• Hazard identification and risk assessment records (Clause 6.1.1)
  
  
• Legal and other requirements register (Clause 6.1.3)
  
  
• Competence and training records (Clause 7.2)
  
  
• Communication records (Clause 7.4.1)
  
  
• Emergency preparedness and response plan (Clause 8.2)
  
  
• Maintenance and performance evaluation (Clause 9.1.1)
  
  
• Compliance evaluation (Clause 9.1.2)
  
  
• Internal audit program and report (Clause 9.2.2)
  
  
• Management review records (Clause 9.3)
  
  
• Incident investigation records (Clause 10.2)
  
  
• Nonconformity and corrective action records (Clause 10.2)
  
  
• Evidence for continual improvement (Clause 10.3)

This reflects the mandatory documented information requirements in ISO 45001:2018. Your organization may need additional records depending on scope and operational risk profile.

Document control is where teams consistently lose time. Version conflicts, missing approvals, outdated procedures that no one updated. The blog on key features of compliance management software explains what a reliable document control system needs to handle this without last-minute scrambles.

Common audit failures and how to avoid them

Most certification audit failures are not surprises. They are things organizations knew were gaps and did not get to before the audit date.

Improper OH&S policy

The OH&S policy that nobody knows about. It exists in a document folder. Workers have never seen it. That fails Clause 5. Adding policy communication records, toolbox talk sign-offs, or onboarding documentation closes it.

Having an outdated legal register

A legal register from two years ago. That is a major nonconformity under Clause 6.1. 3. Regulations change. The register needs a review date and a name attached to that review. Schedule quarterly legal register checks and log the outcome each time.

No proper corrective actions

Corrective actions marked closed with no effectiveness evidence. This shows up in almost every certification audit. Closing a corrective action without confirming the root cause was actually addressed is a consistent finding across certification bodies. Every closure needs a signed effectiveness check with a date.

Not having an emergency plan tested

An emergency plan that has never been tested. A plan that is not tested is nothing more than a documentation, not a response capability. Certification bodies ask for records. Run at least one full emergency simulation per audit cycle and document what happened and what changed as a result.

To take it up a notch, go through the ISO 45001 compliance to see if all the regulations are being followed and you won’t make a mistake. 

How to stay audit-ready year-round

Certification is assessed at a point in time. Keeping the certificate requires the OHSMS to function between audit cycles, not just before them.

Run quarterly internal reviews

Run quarterly internal reviews against the checklist. Annual internal audit cycles catch things late. Quarterly checks catch drift before it reaches the level of a major nonconformity.

Update your document control

Keep document control current in real time. Every procedure change needs a version update, an approval record, and the prior version archived. The blog on how automated document processing helps avoid compliance penalties explains why manual document management creates the most preventable compliance failures organizations face.

Properly track your corrective actions

Track corrective actions in a shared system with more than one user. A spreadsheet owned by one person is a single point of failure. When that person transitions out of the role, the corrective action record goes with them.

This can seem more relevant if you understand the process of getting ISO 45001 certified, as you can grasp the gist of how to get certified.

Your ISO 45001 checklist is ready. What's next?

Plenty of organizations treat the ISO 45001 checklist as a pre-audit formality. They run through it once, close the obvious gaps, and hope nothing else surfaces on audit day. Don’t be like this.

The ones that pass Stage 2 on the first attempt built their OHSMS around the checklist from the start. The difference between those two  is usually visible in the documentation before an auditor asks a single question.

‍P3 LogiQ gives safety and compliance teams one platform to manage every clause of ISO 45001: document control, corrective action tracking, audit scheduling, and compliance monitoring across your full OHSMS. You run the safety program. P3 LogiQ keeps the records clean, connected, and ready when it counts.

Start your ISO 45001 compliance journey with us today.

Your next audit does not have to be a scramble. We will help keep your OHSMS organized, traceable, and ready at all times.

You can either Sign up or book a demo with us. We can help you get your ISO certification sorted!

Frequently asked questions about ISO 45001 checklist

What is the difference between an internal audit and a certification audit for ISO 45001?

Think of Internal Audit more like a mock audit done by your team just to see if your business is truly following and implementing ISO standards and not leaving any gaps. Think of certification audit as like the main exam, the main audit that happens where the auditor will thoroughly check and confirm if your work processes have been set as per the ISO standard. Both require documented findings and corrective actions. Only the certification audit produces an issued certificate, and only if no unresolved Major Nonconformities remain.

How many clauses does the ISO 45001 checklist cover?

The audit checklist covers clauses 4 through 10. These seven clauses contain all normative requirements of the standard. Clauses 1, 2, and 3 are informational, covering scope, normative references, and definitions, and they are not assessed during any audit.

How often should you run an internal ISO 45001 audit?

ISO 45001 does not set a fixed frequency. It requires internal audits at planned intervals based on the risk level and importance of the processes being evaluated. Most certification bodies expect a full internal audit cycle at least once annually. Organizations with higher-risk operations often run targeted audits against specific clauses more frequently than that.

Can a small business use the same ISO 45001 checklist as a large organization?

ISO 45001:2018 applies to organizations of all sizes. The clause structure does not change based on company size. What changes is the depth of evidence expected. A 20-person manufacturing business and a 5,000-person logistics company audit against the same clauses. Their records, procedures, and controls reflect their own operational contexts and risk profiles.

What happens if your organization fails a certification audit?

A failed Stage 2 audit produces a list of nonconformities. With the nonconformities you got, you are required to have a corrective action plan that should be submitted to the CB within a deadline of mutual understanding. Major nonconformities require a re-audit of the affected areas before certification is granted. Organizations are not permanently disqualified. The majority reach certification after addressing findings from their first attempt, provided the corrective actions close the actual root causes.

‍