Management system guidance
9.0 Performance Evaluation
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
9.2 Internal audit
ISO 45001 clause 9.2 requires your organization to carry out internal audits at planned intervals. These audits tell you whether the OH&S management system conforms to your own requirements – including the OH&S policy and OH&S objectives – and to the requirements of ISO 45001, and whether it is effectively implemented and maintained.
9.2.1 General
Internal audits are a key part of the Check stage of PDCA. They give top management an independent view of how well the OH&S management system is working in practice, highlight where hazards are not being adequately controlled, and identify opportunities to improve. The audit process can also support the evaluation of compliance with legal requirements and other requirements.
9.2.2 Internal audit programme
Your organization needs to plan, establish, implement and maintain an audit programme. The programme should define:
- The frequency and methods of audit;
- Responsibilities for planning, conducting and reporting audits;
- How workers will be consulted (see 5.4);
- Planning requirements and reporting arrangements.
When setting up the programme, take into account the importance of the processes concerned and the results of previous audits. ISO 45001 also advises that the extent of the programme should reflect the complexity and maturity of the OH&S management system.
Applying risk-based thinking to the programme
Audit frequency should be driven by OH&S risk and performance rather than a fixed clause-by-clause rotation. Consider auditing more often:
- Activities with high OH&S risks, such as work at height, confined spaces, hazardous substances, lifting operations or lone working (see 6.1.2);
- New or changed processes, equipment, sites or organizational structures (see 8.1.3);
- Areas with poor incident, near-miss or inspection trends;
- Processes that rely heavily on contractors or outsourced functions (see 8.1.4);
- Areas with previous audit nonconformities or open corrective actions;
- Activities subject to significant legal requirements.
Mature, stable processes that have shown good results in previous audits can be audited less often. Over the audit cycle, every part of the OH&S management system and every clause of ISO 45001 should be covered.
Audit criteria, scope and auditor selection
Define the criteria and scope of each audit – for example, “ISO 45001 clauses 8.1.2 and 8.1.4, the site hot-work procedure and contractor rules, at the warehouse”. Auditors must be selected and audits conducted so that the process is objective and impartial. In a small organization, this can be achieved by ensuring people do not audit their own work, by separating the internal auditor role from normal duties, or by using external auditors. Auditors should be competent (see 7.2); ISO 19011 provides guidance on auditing and auditor competence.
Clause 5.4 requires your organization to emphasize the consultation of non-managerial workers on planning, establishing, implementing and maintaining the audit programme. Involving workers as audit team members, or as interviewees during audits, is also a practical way to strengthen participation and draw on their first-hand knowledge of how work is really done.
Reporting audit results
ISO 45001 goes further than many management system standards on reporting. Your organization must:
- Report audit results to relevant managers;
- Report relevant audit results to workers and, where they exist, workers' representatives (for example, a safety committee); and
- Report relevant results to other relevant interested parties, such as contractors whose work was audited.
Acting on findings
Action must be taken to address nonconformities and to continually improve OH&S performance. Audit nonconformities should be managed through 10.2 Incident, nonconformity and corrective action, and improvement opportunities considered under 10.3 Continual improvement. Audit results, and trends in them, are a required input to management review.
Documented information
Retain documented information showing that the audit programme has been implemented, together with the results of each audit – typically the audit programme or schedule, audit plans, checklists and notes, audit reports, and records of nonconformities and follow-up. Our health and safety management system templates include an audit procedure, programme and report forms.
You should seek and record evidence that your organization has planned and implemented an internal audit programme that defines frequency, methods, responsibilities, consultation, planning and reporting; that the programme takes account of process importance and previous audit results; that audit criteria and scope are defined for each audit; that auditors are objective and impartial; that results are reported to relevant managers, workers, workers' representatives and other relevant interested parties; that nonconformities are actioned; and that documented information of the programme and audit results is retained.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.