SHEQ managersCompliance officersInternal auditorsProcess plantsMines

    ISO 45001 Internal Audit Checklist Template

    A clause-by-clause checklist for an internal audit of an occupational health and safety management system against ISO 45001:2018, as amended in 2024 for climate change. The auditor records the evidence seen and a finding per clause; the auditee gets the actions.

    At the intervals the audit programme sets, normally so that every clause is covered at least once a year, and before the certification body visits.

    An inspector with a checklist at stainless process equipment

    What is in the template

    Clauses 4 to 6: context, leadership and planning

    Columns: Clause · Requirement in short · Evidence seen · Finding (C/OFI/NC) · Action owner · 8 rows per page

    Clause 4 asks whether the organisation has worked out its context, its interested parties and the scope of the system, and, since the 2024 amendment, whether climate change is a relevant issue (4.1) and relevant to interested parties (4.2). Clause 5 asks whether top management leads it, has a policy, assigns roles and consults workers. Clause 6 asks whether hazards are identified and risks assessed (6.1.2), legal requirements determined (6.1.3) and objectives set with plans to reach them. Finding: C complies, OFI opportunity for improvement, minor NC or major NC.

    Clauses 7 and 8: support and operation

    Columns: Clause · Requirement in short · Evidence seen · Finding (C/OFI/NC) · Action owner · 8 rows per page

    Clause 7 asks whether there are resources, competent people (7.2), awareness, communication and controlled documented information. Clause 8 asks whether operations are planned and controlled (8.1), including the hierarchy of controls, management of change, procurement and contractors, and whether emergency preparedness and response is in place and tested (8.2).

    Clauses 9 and 10: performance evaluation and improvement

    Columns: Clause · Requirement in short · Evidence seen · Finding (C/OFI/NC) · Action owner · 8 rows per page

    Clause 9 asks whether performance is monitored and measured (9.1), including evaluation of legal compliance, whether internal audits run to a programme (9.2) and whether management reviews happen with the required inputs and outputs (9.3). Clause 10 asks whether incidents and nonconformities are investigated, corrective actions taken and their effectiveness reviewed (10.2), and whether the system improves continually.

    Summary and sign-off

    • Number of findings (C / OFI / minor NC / major NC)
    • Nonconformities (clause and one line each)
    • Corrective actions due by
    • Auditor signature and date
    • Auditee signature and date

    How to fill it in

    1. 1Agree the scope and the date with the auditee beforehand, and read the last audit report and the open corrective actions before you start.
    2. 2Take each clause group in turn. In the clause column write the sub-clause you are checking (for example 6.1.2), and in the requirement column what it asks for in a few words.
    3. 3Record only evidence you saw or were shown: the document number, the record, the person interviewed, the place. "They said it is done" is not evidence.
    4. 4Grade each line. A major NC is a requirement not met at all or a failure that could cause harm; a minor NC is a lapse in an otherwise working process; an OFI is a suggestion, not a failure.
    5. 5Close the audit with the summary, agree an owner and a due date for every nonconformity, and move them to the corrective-action register.

    A general template, not legal advice. Check it against the Act, the regulations and the codes of practice that apply to your site, and against your own safety management system. ISO 45001:2018 clause 9.2 requires internal audits at planned intervals to determine whether the occupational health and safety management system conforms to the organisation's own requirements and to the standard, and is effectively implemented and maintained; clause 10.2 requires nonconformities found to be acted on, corrected and their effectiveness reviewed. The standard is voluntary; the legal duties the system covers come from the OHS Act or the MHSA and their regulations.

    Convert this template into a digital form

    Run it on an Android phone with no signal, attach photos as evidence, and every failed item raises an issue with an owner and a due date.

    Start free trialBook a demo

    The same record in Inspecable

    On paper the register is only as current as the last person who updated it. In Inspecable the same record keeps going:

    Do it in InspecableLegal registerThe longer readDigitising Mine Safety: From Paper to Records You Can Produce

    Questions

    How often must ISO 45001 internal audits be done?

    At the intervals your own audit programme sets; the standard does not fix a frequency. Most sites cover every clause at least once a year, spread over several audits, and audit high-risk processes more often. Clause 9.2.2 requires the programme to consider the importance of the processes and the results of previous audits.

    Can the SHEQ manager audit their own system?

    Not the parts they run. Clause 9.2.2 requires auditors to be objective and impartial, so someone who owns a process should not audit it. A trained person from another department, another site or a contracted auditor audits the SHEQ function; the SHEQ manager can audit the operational areas.

    What is the difference between a major and a minor nonconformity?

    A major nonconformity is a requirement not met at all, or a breakdown that could lead to harm or to legal non-compliance; a minor one is an isolated lapse in a process that otherwise works. ISO 45001 does not define the grades; the certification body does, so use its definitions on your internal audits.

    More free templates

    Looking for an inspection checklist instead? Free checklists.