Preparing For An OHSAS 18001 Or ISO 45001 Internal Audit

An internal audit gives an organisation a structured way to test whether its occupational health and safety management system works in practice. It examines more than policies and certificates. A useful audit checks how hazards are identified, how workers participate, whether controls are applied, and how the business learns from incidents, inspections and changing conditions.

For Australian organisations, preparation should connect the management system with applicable work health and safety duties. Requirements can vary between jurisdictions, with different regulators and legislation applying in New South Wales, Victoria, Queensland, Western Australia and other states and territories. A well-planned audit therefore considers ISO 45001 requirements alongside local WHS obligations, contractor arrangements and the risks found in the organisation’s actual workplaces.

Clarify The Standard And Audit Scope

OHSAS 18001 is a legacy occupational health and safety standard. It was replaced internationally by ISO 45001, which places greater emphasis on organisational context, leadership, worker consultation, risk and opportunity, and integration with business processes. An organisation still operating with an OHSAS-based system should treat the internal audit as an opportunity to identify transition gaps rather than simply repeat an old checklist.

Before the audit begins, define the sites, activities, departments, shifts and support functions included in the scope. A company based in Perth may need to include a head office, a remote mining operation and contractor-managed transport. A business in Melbourne may need to cover warehouses, laboratories, mobile workers and subcontractors. The scope should reflect where work is performed and where safety risks are controlled, rather than being limited to the main administrative office.

Set the audit criteria in writing. These may include ISO 45001 clauses, internal procedures, risk assessments, emergency plans, customer requirements, licence conditions and applicable Australian WHS legislation. Confirm whether the audit is assessing certification readiness, routine system performance, a particular high-risk process or progress after corrective action. Clear criteria make the final report more consistent and help managers understand why evidence has been requested.

Build An Evidence-Based Audit Plan

A practical audit plan identifies the audit team, dates, locations, processes, responsible contacts and methods of collecting evidence. Allow enough time for interviews, record sampling, workplace observation and follow-up discussions. A document review alone cannot show whether workers actually use a permit-to-work process or whether isolation controls are effective during maintenance.

Use risk to guide the audit schedule. High-risk activities such as confined-space entry, lifting operations, electrical work, process isolation, work at height and hazardous chemical handling deserve closer attention than low-risk administrative activities. The plan should also consider recent incidents, complaints, regulator notices, organisational changes, new equipment and areas with repeated corrective actions.

Sampling should be representative rather than convenient. Review records from different teams, locations and shifts, including night work where relevant. In a Queensland processing facility, for example, an auditor might compare day-shift and night-shift pre-start records, interview operators and observe how control-room instructions reach field personnel. In a FIFO operation in Western Australia, the sample may need to include mobilisation, accommodation, fatigue controls, contractor induction and communication with workers who are away from the main site.

Prepare an evidence request before the audit, but avoid asking for every document the organisation possesses. Useful records may include the legal register, risk and opportunity assessments, consultation minutes, training and competency records, incident investigations, inspection results, emergency exercise reports, contractor evaluations, maintenance records and management review outputs. A focused request reduces disruption and directs attention towards the processes that matter most.

Check Leadership, Consultation And Accountability

ISO 45001 expects senior leaders to take visible responsibility for the WHS management system. During the audit, look for evidence that safety objectives are connected to business planning, resources, operational decisions and performance reviews. A signed policy is weak evidence if managers cannot explain current safety priorities or if production pressures routinely override agreed controls.

Interview people at different levels of the organisation. Ask leaders how they identify significant risks, how they know controls are working and how they respond when performance declines. Ask supervisors how they manage changes, contractors and incomplete work. Ask workers how they report hazards, stop unsafe work, access procedures and receive feedback. Consistent answers are often more valuable than polished presentations.

Worker participation is especially important under Australian WHS frameworks. Check whether health and safety representatives, committees, toolbox meetings, pre-starts and consultation arrangements are active and accessible. Records should show what was discussed, who contributed, what decisions were made and whether actions were closed. A consultation meeting that records attendance but never captures worker concerns may not demonstrate meaningful participation.

Also test role clarity. Workers should understand who can approve a risk assessment, isolate equipment, investigate an incident, authorise a contractor or activate an emergency response. Position descriptions, competency matrices and delegation records can support this evidence, but direct interviews and observation reveal whether those arrangements function under normal working conditions.

Examine Operational Controls And Emergency Readiness

The central question in an internal audit is whether planned controls are operating as intended. Select several significant hazards and follow them through the system: identification, risk assessment, control selection, implementation, communication, monitoring and review. This approach exposes gaps that a clause-by-clause document check can miss.

For example, trace the management of hazardous chemicals from procurement and storage through to use, spill response and disposal. Check labels, safety data sheets, bunding, ventilation, personal protective equipment, training and exposure monitoring. For electrical work, examine authorisation, isolation, test-before-touch practices, permits and restoration of service. For plant maintenance, compare the documented lockout procedure with what workers actually do at the equipment.

Contractor management should receive careful attention. Review how contractors are selected, inducted, supervised and evaluated. Confirm that the host organisation and contractor understand who controls each risk, how incidents are reported and how changes are communicated. Construction, infrastructure and resources businesses across Sydney, Brisbane and Perth often rely on several layers of subcontracting, making interfaces a frequent source of confusion.

Emergency preparedness requires observation as well as paperwork. Check whether emergency scenarios reflect credible events, such as a chemical release, fire, serious injury, loss of power, extreme heat or severe weather. Review drill results, response times, equipment inspections and lessons learned. A plan that looks complete but has never been tested with a night shift or an impaired communication channel provides limited assurance.

Evaluate Findings, Corrective Action And Follow-Up

Audit findings should be based on verifiable evidence and linked to a clear requirement. Separate nonconformities from observations and opportunities for improvement. A nonconformity should explain what was expected, what was found and why the gap matters. Avoid vague wording such as “safety needs improvement”; identify the missing approval, incomplete inspection, ineffective control or unavailable record.

Discuss factual accuracy with process owners before the audit closes. This does not mean negotiating away legitimate findings. It gives the organisation an opportunity to provide overlooked evidence, correct misunderstandings and agree on the immediate containment needed. Findings should be prioritised according to risk, legal significance, recurrence and the potential for serious harm.

Corrective action should address the cause rather than only the visible symptom. If workers repeatedly miss a pre-start inspection, replacing a damaged form may not solve the problem. The underlying cause could be unclear responsibility, unrealistic timing, poor supervision, inadequate training or a digital system that is difficult to access in the field. Require an owner, due date, action plan and method for checking effectiveness.

Follow-up is essential. Review whether actions were completed, whether the change was implemented at the relevant workplace and whether the risk has actually reduced. Trends from internal audits should feed into management review, safety objectives and future audit programmes. Recurring findings may indicate a system weakness requiring broader action across multiple sites.

A capable internal auditor needs knowledge of the standard, audit methods, WHS risk and the work being examined. Independence does not always require an external auditor; it means the person should not audit their own work without suitable safeguards. Training, supervised audits and experience in realistic operational environments can strengthen auditor judgement, particularly for process, energy, engineering, electrical and high-risk industrial activities.

For organisations developing this capability, practical training is often more effective when it connects classroom learning with live-process conditions. HCF CATCH provides industrial training in a realistic process-plant environment, covering safety, engineering, electrical, industrial gas, energy and renewable operations. Its courses and facilities can support organisations that want personnel to understand both management-system expectations and the physical controls used in industry.

An effective internal audit should leave the organisation with a reliable picture of its WHS performance, clear priorities and actions that reduce risk. Prepare the scope, involve workers, test what happens in the field and use findings to improve the system before a certification or regulatory review. Explore practical safety and industrial training options with HCF CATCH to build stronger audit capability across your workforce.