Corrective action under ISO 45001: what clause 10.2 asks you to prove
International: ISO 45001. This guide paraphrases clause 10.2 of ISO 45001:2018. The standard's text is copyrighted, so nothing here quotes it; read your licensed copy for the exact wording. ISO's own page says a revised edition is expected, so check clause numbers against the edition you are certified to.
Take an example register: 140 actions, 138 marked closed. The auditor picks six and asks to see each one. For four of them the closure is a tick and a date, entered by the person the action was assigned to, on the day it was raised. None says what was changed. Nobody checked whether the change worked. Two of the six hazards turn up again in later inspection reports. The register looks almost complete, and it proves almost nothing.
What clause 10.2 covers
Clause 10.2 is titled "Incident, nonconformity and corrective action". In plain terms, it expects you to have a process for reporting, investigating and acting on incidents and nonconformities, and when one happens, to:
- React in time. Take action to control and correct it, and deal with the consequences.
- Look for the cause, with the workers involved. Evaluate whether action is needed to remove the root causes so it does not happen again or somewhere else. That means investigating, finding the causes, and checking whether similar incidents or nonconformities exist or could occur.
- Revisit the risk. Review the existing assessments of health and safety risks and other risks, where that is appropriate.
- Act in the right order. Decide and carry out the action, following the hierarchy of controls (clause 8.1.2) and the management of change (clause 8.1.3), and assess the risks of any new or changed hazards before acting.
- Check it worked. Review the effectiveness of what was done, and change the management system itself if needed.
- Keep the record and tell people. Retain documented information as evidence of what happened, what was done and the results, including effectiveness, and communicate it to the relevant workers and other interested parties.
The actions are expected to be proportionate to the effects, or potential effects, of what happened.
What an auditor samples
Certification auditors usually work from a sample rather than the whole register, and trace each sampled item from start to finish. For each sampled action, expect questions like these:
| Step | What the auditor looks for | Evidence that answers it |
|---|---|---|
| The event | What happened, where and when; incident or nonconformity | A report with date, location and photos |
| Immediate reaction | How it was controlled and corrected at the time | The immediate action, who took it, when |
| Cause | An investigation that goes past "human error"; who took part | The investigation record, its method and participants |
| Wider check | Could it happen elsewhere? Was the risk assessment reviewed? | A note of other areas checked; the risk assessment revision |
| Action | A fix chosen against the hierarchy of controls, with an owner and a due date | The action record, and the change process if the fix changed something |
| Effectiveness | Did it work, judged after enough time has passed | A dated effectiveness review with the reviewer's name |
| Record and communication | Kept, retrievable, shared with the workers concerned | The retained record; a briefing or toolbox talk note |
If one step has no evidence, the trace breaks there.
Why a tick is not a closure
- A tick records a claim, not a fact. "Closed" says someone believes it is done. It does not show what was done.
- The closer marked their own work. When the assignee closes the action, nobody independent has looked at it.
- Closed the day it was raised. That leaves no time to see whether the fix worked. Closure and effectiveness are different moments.
- "Retrained the operator" every time. Training is an administrative control, low in the hierarchy of controls. When it is the default answer, an auditor will ask why elimination, substitution or an engineering control was not considered.
- The same finding comes back. Recurrence is the plainest evidence that the cause was not found or the fix did not work.
A register that holds up
Whether it lives in a spreadsheet or in software, a corrective action register that survives sampling carries, for each action: a reference, the source (inspection, incident, audit), the date raised, what was found, the immediate action, the root cause, the action chosen and its place in the hierarchy of controls, one owner, one due date, how it was verified, the evidence, who closed it and when, and the effectiveness review with its date, result and reviewer. Our corrective action register template lays these columns out.
Effectiveness: the step most registers skip
Decide when you raise the action how you will know it worked, and when you will check. A guard fitted to a conveyor might be checked at the next two inspections of that conveyor. A changed procedure might be checked by observing the task a month later. If the review finds the fix did not work, raise a new action linked to the first one rather than quietly reopening it. The link is what shows an auditor the loop kept turning.
Where Inspecable fits
In Inspecable, inspections run offline on Android, and a failed item raises a tracked issue with a severity and a due date on the spot, so the event and its time are recorded where they happened. An action cannot close without a verification method, evidence and a signature, and the person closing it cannot be the person it was assigned to. A signed effectiveness review follows, and an ineffective result opens a linked child action. Every inspection carries a hash-chained history you can verify on demand, and a date range of completed inspections exports as one ZIP for the auditor.
This is a general guide, not legal advice.
Frequently asked questions
Does ISO 45001 require root cause analysis?
Clause 10.2 expects you to evaluate, with worker participation, whether action is needed to remove the root causes of an incident or nonconformity, which means investigating and determining its causes. It does not prescribe a method; 5-Whys or a fishbone diagram are common choices.
What records does ISO 45001 clause 10.2 expect?
Documented information as evidence of the nature of each incident or nonconformity, the actions taken, and their results, including whether they were effective. In practice that is the report, the investigation, the action, the closure evidence and a dated effectiveness review.
Who should close a corrective action?
The standard does not name a role. Good practice is that someone other than the person who did the work verifies and closes it, with the method and evidence recorded, so the closure is a check rather than a self-declaration.
References
- [1]ISO 45001:2018, Occupational health and safety management systems: Requirements with guidance for use (ISO): https://www.iso.org/standard/45001
Ready to Transform Your Mining Operations?
Run your inspections on a phone with no signal, and close every failed item with evidence and a signature.
About Inspecable Team
Safety, Inspection and Field Operations
We build safety, inspection and asset management software for mines, process plants and heavy industry, with inspections that run offline on Android.
Related Articles
TRIR vs LTIFR: two safety rates, two bases
TRIR counts every OSHA-recordable case per 200,000 hours worked. LTIFR counts lost-time injuries per 1,000,000 hours. Same site, same year, very different numbers. Here is how each is built, how to convert between them, and what neither one shows.
Pre-use inspections under OSHA: forklifts, cranes and mobile plant
OSHA requires forklifts to be examined before use, construction cranes to be inspected every shift, and jobsite vehicles to be checked at the start of each shift. It mostly does not say how to record it. Here is what the rules say and what a record that holds up contains.
The Hidden Cost of Paper-Based Mining Inspections
If you're a safety officer or operations manager in South Africa's mining sector still using paper inspection forms, paper is probably costing you more than you realize.