ISO-45001-Lead-Auditor PECB Certified OHSMS ISO 45001 Lead Auditor Exam Question and Answers

ISO 45001 emphasizes worker participation and engagement at all levels of the organization to support continuous improvement (Clause 5.4 and Clause 10.3). Continuous improvement requires input from everyone, including workers who identify hazards, report incidents, and contribute to safety enhancements.

Analysis of Options:

A. Everyone, at all levels of the company:Correct. Clause 5.4 explicitly includes all levels of the organization in consultation and participation, fostering continuous improvement.

B. Top management and senior officers only:Incorrect. While top management plays a crucial role in leadership, ISO 45001 extends the responsibility for participation to all levels.

C. Top management, senior officers, and designated safety representatives only:Incorrect. Limiting participation to designated representatives excludes a significant portion of the workforce from the improvement process.

D. Top management only:Incorrect. While top management must lead and commit to continuous improvement, their involvement alone is insufficient under ISO 45001.

ISO References:

Clause 5.4: Worker consultation and participation.

Clause 10.3: Continual improvement.

Clause 10.2 of ISO 45001 requires organizations to investigate incidents, determine root causes, and implement corrective actions to prevent recurrence.

Analysis of Options:

A. Check whether corrective actions were taken.This directly relates to the requirement to implement corrective actions to address the identified risks and hazards. Failure to do so would indicate nonconformity.

B. Determine whether the Health and Safety Authority was notified.Notification is a legal requirement in certain jurisdictions, but it is not explicitly required under ISO 45001 unless the legal context demands it.

C. Establish whether the root cause was determined.Root cause analysis is fundamental for effective corrective action. Without this, corrective measures may not address the underlying problem.

D. Find out when the operator ' s machine was last subject to maintenance.While maintenance is important, it does not directly address the incident ' s nonconformity.

E. Find out whether the operator was sent to the hospital.Sending the operator to the hospital is a reactive step and not relevant to compliance with Clause 10.2.

F. Interview the operator about PPE usage.This is relevant but insufficient for determining compliance with Clause 10.2.

ISO References:

Clause 10.2: Investigation of incidents, determination of causes, and implementation of corrective actions.

Clause 8.1.2: Hierarchy of controls and risk reduction.

These four actions develop meaningful audit trails from the evidence already obtained. Reviewing safety-awareness training tests whether the organisation ' s claimed control is competently implemented. Comparing incident data with shopper numbers provides a meaningful performance measure rather than relying on raw incident totals, consistent with Clause 9.1.1. Reviewing hazard identification specifically for escalators evaluates conformity with Clause 6.1.2, because recurring escalator incidents indicate a hazard requiring systematic consideration. Finally, checking incident investigations tests Clause 10.2 requirements to react to incidents, determine causes and identify corrective actions necessary to prevent recurrence. A zero-incident policy is not an ISO 45001 requirement, retail tenants do not have to be independently certified, and questioning top management ' s knowledge of the standard would not directly investigate the observed incident trend. The Centre Manager ' s qualifications are similarly secondary to evaluating actual system effectiveness.

Clause 5.4 of ISO 45001:2018 emphasizes the importance of worker consultation and participation in the OHS management system. It requires organizations to establish processes that ensure workers are actively involved in decision-making and implementation of OHS practices.

Analysis of Options:

A. Promoting collaborating workers to higher positions:While promotions may boost morale, they do not directly contribute to worker consultation and participation in the OHSMS.

B. Appointing worker representatives:This action fosters direct communication and representation of workers ' interests in health and safety matters.

C. Conducting toolbox talks on health and safety:Toolbox talks are an effective way to engage workers in discussing and addressing health and safety issues.

D. Giving ownership of health and safety matters:Involving workers in decision-making and giving them responsibility for specific health and safety tasks encourages participation.

E. Ignoring workers ' suggestions:This undermines consultation and is contrary to ISO 45001 principles.

F. Implementing a payment scheme to reward workers ' OHS performance:While incentives can motivate safe behavior, they are not a consultation or participation mechanism as required by Clause 5.4.

G. Implementing methods for engaging workers:This aligns directly with Clause 5.4, as effective engagement methods (e.g., surveys, focus groups) enhance participation.

H. Threatening reprisals to whistleblowers:This violates ISO 45001 principles and discourages worker participation.

ISO References:

Clause 5.4: Worker consultation and participation.

Clause 5.1: Leadership’s responsibility to foster participation.

The PDCA cycle (Plan-Do-Check-Act) is a core framework in ISO 45001 for continual improvement of the OH and S management system. An Environmental Management Program is part of ISO 14001 (Environmental Management System) and not ISO 45001.

Analysis of Options:

A. Treatment of Risks:Correct. Risk treatment is part of the Plan phase.

B. OHSMS Policy:Correct. The policy is developed in the Plan phase.

C. Environment Management Program:Incorrect. This is outside the scope of ISO 45001 and relates to ISO 14001.

D. Analyzing OHSMS Performance:Correct. Performance analysis is part of the Check phase.

ISO References:

Clause 0.3: PDCA framework in ISO 45001.

Clause 5.1 of ISO 45001:2018 requires top management to demonstrate leadership and commitment to the OH and S management system. This includes awareness of the OH and S policy and its objectives.

Analysis of Options:

A. As a member of the management team, the Deputy College Principal is not aware of the OHSMS policy:Correct. A lack of awareness of the policy reflects poor leadership commitment, which violates Clause 5.1.

B. OH and S improvement is not possible due to the lack of awareness of the OHSMS:Incorrect. While improvement may be hindered, this is not the main issue in this scenario.

C. The Deputy College Principal is not competent to manage the OHSMS:Incorrect. The Deputy’s competence to manage the OHSMS is not in question; the issue is their lack of awareness of key elements.

D. The OH and S policy only exists as a document in the College Principal’s office:Incorrect. The policy may be accessible but not effectively communicated or understood by management.

ISO References:

Clause 5.1: Leadership and commitment.

Clause 5.2: OH and S policy.

An audit trail for evaluating compliance with regulations should focus on the identification, communication, and monitoring of legal and other requirements. Clause 9.1.2 of ISO 45001:2018 requires organizations to evaluate compliance with applicable OH and S legal and other requirements.

Analysis of Options:

A. What is the cost of repairing the wall?Irrelevant to compliance evaluation, as cost considerations are not part of legal compliance.

B. What hazards have been identified as being associated with regulations?Correct. Identifying hazards is a critical step in understanding compliance obligations (Clause 6.1.2).

C. How are maintenance staff made aware of regulatory requirements?Correct. Communication and training are vital for compliance (Clause 7.3).

D. How are OH and S objectives verified?Not directly relevant to compliance evaluations, as objectives pertain to performance improvement.

E. How are OHSMS records of compliance evaluations controlled and managed?Correct. Proper documentation and record-keeping are essential for demonstrating compliance (Clause 7.5).

F. How are updates to OH and S regulations monitored?Correct. Monitoring regulatory changes is critical for maintaining compliance (Clause 6.1.3).

G. How is the cost of safety improvements calculated?Irrelevant to compliance, as cost analysis is not required by ISO 45001.

H. What are the qualifications of the OHS Manager and Maintenance Manager?While competence is important, this does not directly relate to compliance evaluations.

I. What input does the Maintenance Manager have in the determination of legal compliance?Correct. Understanding the roles and responsibilities of key personnel ensures effective compliance (Clause 5.3).

J. What knowledge does the OHS Manager have in relevant safety legislation?Correct. Awareness of applicable legislation is critical for effective compliance evaluation (Clause 7.2).

ISO References:

Clause 9.1.2: Evaluation of compliance.

Clause 6.1.2: Hazard identification and risk assessment.

Clause 7.5: Documented information.

The best answer is B.

Under ISO 45001, worker consultation and participation is required by Clause 5.4, but the standard does not require a specific documented procedure for that clause. The organization must provide mechanisms, information, time, training, and resources for consultation and participation, but ISO 45001 does not say it must maintain a formal procedure specifically for this.

Also, ISO 45001 Clause 7.5.3 requires documented information to be controlled so that it is available and suitable for use, and adequately protected. An “obsolete” document is not automatically a nonconformity just because it exists. It may be retained for reference or historical reasons, provided the organization controls it properly and it is not being used unintentionally as current information. That is why the correct audit reaction is to note it and verify on site whether it is actually part of the current controlled documented information.

Why the other options are not the best:

A is weak because using an obsolete procedure to prepare the checklist risks relying on invalid information before confirming what the current controlled version is.

C is unnecessary as the first response. You already have enough evidence to note a potential document-control point and verify it during the audit.

D is incorrect because you should not raise a nonconformity before verifying the facts on site. An obsolete-marked document alone does not prove a breach of Clause 7.5.3. A nonconformity must be based on objective evidence gathered during the audit.

Explanation

Prepares the audit report → Audit Team Leader:The Audit Team Leader is responsible for compiling and preparing the final audit report, summarizing findings and conclusions.

Prepares audit checklists for use during the audit → Auditor:Auditors create checklists to ensure a thorough and systematic evaluation during the audit.

Participates under the direction and guidance of an auditor → Auditor in Training:An auditor in training works under supervision to gain experience and contribute to the audit process.

Follows up on audit findings within an agreed timeframe → Auditee:The auditee is responsible for addressing and resolving audit findings and providing evidence of corrective actions.

A person who accompanies the audit team but does not act as an auditor → Observer:Observers are typically external parties or internal personnel who watch the audit process but do not participate actively.

Escorts the auditors but does not participate in the audit → Guide:A guide facilitates the audit by helping auditors navigate the site and access relevant areas or documents.

References

ISO 19011:2018: Guidelines for auditing management systems.

Hazard: A potential source of harm or adverse health effects.

Risk: The likelihood of harm occurring as a result of the hazard.

Danger: An immediate threat that requires urgent action.

Analysis of Options:

A. Conference room emergency sign directs people to an exit that is no longer available for use (Hazard):Correctly identified as a hazard since it poses a potential risk during emergencies.

B. The carpet on the main staircase is peeling off (Risk):This is a hazard, not a risk, as it represents a source of potential harm.

C. The emergency light in the gift shop did not work when checked (Risk):This is a hazard because it is a condition that could lead to a risk during emergencies.

D. The fire extinguishers in the Natural World area have not been serviced in the last five years (Risk):Correctly identified as a risk because the likelihood of fire-related harm increases without proper servicing.

E. The head of the dinosaur suspended over the main hall has become detached from the rest of the skeleton (Risk):This is a hazard, not a risk, as it represents a potential source of harm.

F. The non-slip mats have been removed from the restaurant (Risk):This is a hazard, not a risk.

G. There is a high possibility of unfit food being sold due to the failure of the oven temperature indicator in the visitors ' restaurant (Hazard):This is a risk because it specifies the likelihood of harm occurring (selling unfit food).

H. There is a water leak next to the electric heater in the admissions area (Danger):Correctly identified as a danger because it represents an immediate and critical threat.

ISO References:

Clause 6.1.2: Hazard identification and assessment of risks and opportunities.

Clause 4.4 of ISO 45001 requires organizations to establish, implement, maintain, and continually improve an OH and S management system. The corrective actions must address systemic issues, involve leadership commitment, and aim to foster a strong safety culture.

Analysis of Options:

A. Top management initiated a comprehensive review of internal and external issues:Correct. A review of internal and external issues aligns with Clause 4.1 and demonstrates leadership commitment.

B. Union representatives were invited to attend OH and S management meetings:Incorrect. While participation is valuable, it is not a systemic corrective action.

C. Top management developed and is leading a programme to promote an effective culture of support:Correct. Promoting a safety culture is a proactive measure and aligns with Clause 5.1 (Leadership).

D. Staff from departments with nonconformities received regular safety training during toolbox talks:Incorrect. While training addresses specific gaps, it does not address systemic issues.

E. External consultants conducted a gap analysis of the OHSMS:Incorrect. While helpful, this action does not demonstrate leadership or address systemic improvement.

F. OH and S champions were appointed in each department to report near misses and incidents:Incorrect. This is a good practice but does not directly address Clause 4.4’s requirement for systemic improvement.

ISO References:

Clause 4.4: Maintaining and improving the OH and S management system.

Clause 5.1: Leadership and commitment.

Clause 10.3: Continual improvement.

ISO 45001 defines " documented information " as information required to be controlled and maintained by an organization. This can include policies, procedures, records, or other relevant data in any format (Clause 3.19). It encompasses all information used to establish, operate, and demonstrate the effectiveness of the OH and S management system.

Analysis of Options:

A. Any paperwork generated when the system is in operation:Incorrect. This is too narrow and excludes digital or other formats.

B. Any information about the system, or generated by it, held in any format:Correct. This aligns with the ISO 45001 definition in Clause 3.19.

C. Paperwork such as Permits to Work and risk assessments:Incorrect. These are examples of documented information but do not encompass the full scope of the term.

D. The master copies of the documents used to operate the system, held in any format:Incorrect. This definition is limited to master copies, while documented information includes records as well.

ISO References:

Clause 3.19: Definition of documented information.

Clause 7.5: Control of documented information.

The correct answer is D.

ABC states that it has implemented one single OH and S management system for both plants. Once a single management system covers both sites, the certification body has to determine and audit the scope of the management system being operated, not an artificially narrowed commercial scope. IAF MD 1 says a multi-site organization has a single management system, and the certification body must confirm that a single management system is deployed and determine the scope of the management system being operated. It also says the certification document must reflect the scope of certification and the sites/legal entities covered by that multi-site certification. (IAF)

The argument that XYZ is “just a supplier” does not solve the problem. IAF MD 5 makes an important distinction: where an external provider is only a supplier, the certification body audits the organization’s control of the supplied activity, not the performance of the activity itself. But here, XYZ is not outside the management system; ABC has already said both plants are inside one single OHSMS. So XYZ cannot simply be treated as an external supplier for certification-scoping purposes. (IAF)

This is also consistent with the multi-site certification rules that do not allow an organization to exclude covered sites just to avoid certification consequences. IAF MD 1 explicitly says it is not admissible to exclude a problematic site from scope during certification, and the certification documents must show the sites covered by the certified system. While this example is about a “problematic” site, the principle is the same: once the site is part of the single management system, it cannot be carved out simply for convenience or marketing. (IAF)

Therefore, as a third-party auditor, you should not agree to audit only the food plant while ignoring the packaging plant if both are included in the same ISO 45001 management system.

The correct answers are D, F, H.

ISO 19011 guidance on generating audit findings says that nonconformities can be graded depending on the context of the organization and its risks. That directly supports D, because any grading should reflect the risk the nonconformity presents to the organization. The same guidance also says this grading can be quantitative (for example 1 to 5) or qualitative (for example minor/major), which makes F correct. Because the wording is “can be graded”, grading is optional rather than mandatory, so H is also true. (Synersia Foundation)

Why the other options are not true:

A is not a requirement in ISO 19011. An organization may define grading rules in its audit programme or procedure, but there is no rule that grading must be agreed with the individual(s) managing the audit programme. (ISO)

B is false. ISO 19011 does not recommend that top management grade nonconformities. Audit findings are generated by auditors based on objective evidence and audit criteria. (ISO)

C is false. A second-party audit team does not have to adopt the auditee’s grading system. The grading approach can follow the auditing organization’s own rules and purpose for the audit. (ISO)

E is false. Additional documented information at the closing meeting does not mean the grading must be changed. The evidence should be reviewed, but unresolved issues may simply remain recorded in the audit report. (Synersia Foundation)

G is false. There is no requirement that extra grading categories must be agreed with the auditee before the closing meeting. The auditee should understand the findings, but the grading framework is not something ISO 19011 requires to be negotiated at that point. (ISO)

A-Hazard identification, B-Internal Communication, C-Management review, D-Incidents

ISO 45001 structures the OHSMS around the Plan-Do-Check-Act model. Plan includes identifying hazards, assessing OH and S risks and opportunities, determining requirements, and establishing objectives; therefore, Hazard identification belongs to Plan. Do concerns implementation and operation of the management system, including support processes such as communication, making Internal Communication the correct placement. Check covers monitoring, measurement, internal auditing and management review, so Management review belongs to Check. Act addresses improvement following performance evaluation, including responding to incidents, nonconformities and corrective-action requirements; therefore, Incidents belongs to Act. The mapping reflects the ISO 45001 clause architecture: planning in Clause 6, support/operation in Clauses 7–8, performance evaluation in Clause 9, and improvement in Clause 10.

Was he made aware of the hazards related to this work? → Clause 6.1.2.1:Clause 6.1.2.1 focuses on hazard identification. Organizations must identify hazards associated with work activities, such as operating a motorbike, and ensure workers are aware of these hazards.

Was he trained to use the new motorbike? → Clause 7.2:Clause 7.2 requires organizations to ensure that workers are competent to perform their assigned tasks, including providing necessary training for new equipment like a motorbike.

Was he asked to deliver too many orders in a short period of time? → Clause 8.2:Clause 8.2 relates to managing operational controls and ensuring that work processes do not impose undue risks, such as excessive workloads or time pressure.

Was he carrying any contact details in case of an accident? → Clause 7.3:Clause 7.3 requires effective communication of information relevant to OH and S, including emergency contact details or procedures for accidents.

ISO References:

Clause 6.1.2.1: Hazard identification.

Clause 7.2: Competence.

Clause 7.3: Awareness and communication.

Clause 8.2: Operational control.

The best responses are D, E, and G.

D. Insist that the nonconformities must stand since there is clear evidence for them apart from the videos is correct because audit findings and nonconformities must be based on objective evidence. If the evidence supporting the findings exists independently of the videos, then the findings should not be rescinded simply because there is a dispute about how supplementary material was recorded. A problem with auditor conduct or site permission does not automatically invalidate valid audit evidence already obtained.

E. Advise the OHS Manager that they should speak to the supervisor to confirm the situation is also appropriate because the auditor stated that permission had been obtained from a supervisor who was part of the safety team. Before taking action, the audit team leader should verify the facts. This is a reasonable and proportionate response to clarify whether site permission was actually granted.

G. Indicate that he, as audit team leader, will seek approval for the taking of videos by auditors at the opening meetings with management at all audits in the future is appropriate because it addresses the control weakness going forward. Audit teams should be clear about site rules, confidentiality, and permissions for photographs or videos before audit activities begin. This is a constructive preventive action for future audits.

Why the other options are not the best:

A may be premature until the facts are verified.

B assumes misconduct before confirming the facts.

C is incorrect because auditors do not inherently “must” take videos.

F is too severe before the situation is properly established and investigated.

H is inappropriate because the audit team leader should not personally handle or manipulate the auditor’s personal phone.

ISO 19011 distinguishes the generic competence required of all auditors from the additional leadership competence required of an audit team leader. Planning the audit is a team-leader responsibility because the leader must translate the audit objectives, scope and criteria into an effective sequence of activities and coordinate the team ' s work. Likewise, the team leader must make effective use of audit resources, including available personnel, expertise and time, to ensure that the audit objectives can be achieved efficiently. Sampling, applying a risk-based auditing approach, understanding relevant cultural or social factors and verifying collected information are competencies expected of auditors generally rather than being exclusive to team leaders. The ISO 19011 guidance specifically identifies planning the audit and making effective use of resources as additional audit-team-leader capabilities.

ISO 45001 Clause 5.2 OH and S policy requires top management to establish, implement and maintain an OH and S policy that includes a commitment to provide safe and healthy working conditions, fulfill legal and other requirements, and achieve continual improvement of the OH and S management system. It also requires the policy to be communicated within the organization and to be available to interested parties, as appropriate.

B. The management is committed to health and safety improvement is correct because the policy states: “Continual health and safety improvement is a permanent objective of the organisation.” That clearly demonstrates commitment to improvement, which aligns with Clause 5.2.

C. The organisation intends to communicate its policy to external parties is correct because the policy says: “Where required, the policy shall be communicated to all interested parties.” This matches the ISO 45001 requirement that the OH and S policy be available to interested parties, as appropriate.

G. The organisation is committed to continual health and safety improvement is also correct because the statement explicitly says: “Continual health and safety improvement is a permanent objective of the organisation.” This directly reflects the requirement for continual improvement in the OH and S policy.

Why the other options are not supported by the policy statement:

A is not correct because the policy expresses intent to work in accordance with regulations, but it does not prove the organization meets all statutory requirements in practice.

D is not correct because the policy does not provide evidence of reputation.

E is not correct because the policy does not prove that processes actually deliver improvement; it only states commitment.

F is not correct because the policy mentions contractors, but it does not prove that contractors themselves are committed to health and safety.

H is not correct because the policy mentions safe experiences and customers, but it does not prove that customer health and safety requirements are satisfied.

Therefore, the three options for which the organization is meeting ISO 45001 policy requirements are:

B, C, G

The auditor should assess whether the organization ' s planned action (using masks in case of dust extraction failure) is both implemented and effective. This aligns with ISO 45001 requirements to ensure that control measures are functional and meet the intended objectives.

Clause 8.1.2 (Hierarchy of Controls):The use of PPE, such as masks, is considered a last resort in the hierarchy of controls. The organization must demonstrate that the measure is:

Implemented (e.g., PPE is available and workers are trained to use it).

Effective (e.g., masks provide adequate protection against dust).

Analysis of Options:

A. Advise that the factory should cease operations if the dust extraction equipment malfunctioned.While ceasing operations may be a necessary control in extreme situations, it is not a practical or realistic recommendation unless a high-risk scenario cannot be otherwise managed.

B. Ask the OHSMS Manager to confirm regulatory compliance.Regulatory compliance is important but does not fully address the requirement to ensure the action is effective.

C. Seek evidence that the response action is both implemented and effective.This is the most appropriate response. The auditor must verify implementation and effectiveness to determine conformity.

D. Suggest increasing maintenance checks.Maintenance is important for preventing equipment breakdowns, but this option does not address the immediate audit finding about the adequacy of response actions.

ISO References:

Clause 8.1.2: Emphasizes applying the hierarchy of controls effectively.

Clause 9.1.1: Requires monitoring and measuring controls to ensure effectiveness.

2. Prepare the audit checklist, 3. Obtain objective evidence, 4. Review audit evidence, 5. Document findings

For a first-party audit, the sequence follows the normal audit flow described in ISO auditing guidance: first the audit is initiated and leadership is assigned, then audit activities are prepared, then evidence is collected during the audit, then that evidence is evaluated, then findings are recorded, and finally the audit report is issued. ISO 19011 describes the audit flow as initiating the audit, preparing audit activities, conducting audit activities, and preparing and distributing the audit report. (ISO)

That is why, after 1. Appoint an audit team leader, the next correct step is 2. Prepare the audit checklist. The checklist is part of preparing for the audit and helps the auditor plan questions, clauses, process interactions, and sampling points before going on to collect evidence. (WEDEAQ | Official VDA QMC Partner)

After preparation, the auditor moves to 3. Obtain objective evidence. Audit evidence is gathered through interviews, observation, and review of documented information during the audit. This is a core activity of conducting the audit. (DNV)

Once evidence is collected, the auditor must 4. Review audit evidence. ISO audit practice requires the evidence to be evaluated against the audit criteria to determine whether conformity or nonconformity exists. Evidence is not simply collected and reported immediately; it is first reviewed and assessed. (PRETESH BISWAS)

After reviewing the evidence, the auditor can 5. Document findings. Findings are the result of evaluating the evidence against criteria, so they logically come after evidence review. Recorded findings can include conformity, nonconformity, and opportunities for improvement, depending on the audit plan and method. (PRETESH BISWAS)

The final step is 6. Issue the report, because the report is prepared only after the audit evidence has been reviewed and the findings have been determined and documented. (ISO)

So, the correct full order is:

1. Appoint an audit team leader

2. Prepare the audit checklist

3. Obtain objective evidence

4. Review audit evidence

5. Document findings

6. Issue the report

The PDCA (Plan-Do-Check-Act) cycle is a core principle of ISO 45001 and many other management systems. It does not include environmental management, as ISO 45001 focuses on Occupational Health and Safety (OH and S), while environmental aspects are covered by ISO 14001.

Analysis of Options:

A. Treatment of Risks:Correct. Risk assessment and control are part of the Plan phase.

B. OHSMS Policy:Correct. The OH and S policy is established in the Plan phase.

C. Environment Management Program:Incorrect. This is outside the scope of ISO 45001 and pertains to ISO 14001.

D. Analyzing OHSMS Performance:Correct. Performance analysis occurs in the Check phase of the PDCA cycle.

ISO Reference:

Clause 0.3: PDCA model in ISO 45001.