The PECB Certified ISO 45001 Lead Auditor Exam (ISO-45001-Lead-Auditor)

Clause 9.3 of ISO 45001:2018 defines inputs for management review, which must include information on performance trends, feedback, risks, and opportunities for improvement.

Analysis of Options:

A. Allocation of a bigger budget for the OHS department:This is an output of management review, not an input.

B. Decisions on improvements in the OHSMS:This is an output, not an input.

C. Decisions related to continual improvement opportunities:This is an output, not an input.

D. Procurement of new safety harnesses for workers:This is an operational action, not an input for management review.

E. Proposal to prioritize health and safety issues as a business strategy:Proposals may be discussed during review, but they are outputs.

F. Report showing the trend of an increase in safety incidents:Correct. This is a valid input that informs system performance.

G. Updates to the risk register:Correct. Risk updates are required inputs under Clause 6.1.2.

H. Worker feedback of positive and negative comments:Correct. Feedback is an essential input per Clause 5.4 and Clause 9.3.

ISO References:

Clause 9.3: Management review inputs.

Clause 5.4: Worker consultation and participation.

ISO 45001 defines " documented information " as information required to be controlled and maintained by an organization. This can include policies, procedures, records, or other relevant data in any format (Clause 3.19). It encompasses all information used to establish, operate, and demonstrate the effectiveness of the OH and S management system.

Analysis of Options:

A. Any paperwork generated when the system is in operation:Incorrect. This is too narrow and excludes digital or other formats.

B. Any information about the system, or generated by it, held in any format:Correct. This aligns with the ISO 45001 definition in Clause 3.19.

C. Paperwork such as Permits to Work and risk assessments:Incorrect. These are examples of documented information but do not encompass the full scope of the term.

D. The master copies of the documents used to operate the system, held in any format:Incorrect. This definition is limited to master copies, while documented information includes records as well.

ISO References:

Clause 3.19: Definition of documented information.

Clause 7.5: Control of documented information.

A first-party audit is an internal audit. ISO defines internal audits, or first-party audits, as audits conducted by, or on behalf of, the organization itself. That means the people participating can be the organization’s own auditors or external people acting on its behalf, such as a consultant. (ISO)

Therefore:

A. An auditor certified by CQI and IRCA can participate in a first-party audit, provided the auditor is acting for the organization or on its behalf. Certification status does not prevent participation in an internal audit. This is consistent with the principle that first-party audits are defined by who the audit is for, not by the auditor’s credential. (ISO)

D. An auditor from a consultant organisation can also participate, because first-party audits may be carried out on behalf of the organization by a qualified external consultant. (ISO)

E. An auditor trained in the CQI and IRCA scheme can participate for the same reason: training route does not change the audit type; the audit remains first-party if it is conducted by or for the organization. (ISO)

F. An auditor trained by the organisation clearly can participate, since internal audits are commonly performed by trained internal auditors from within the organization. (ASQ)

The two that do not participate in a first-party audit are:

B. A certification body auditor

C. An auditor from an accreditation body

A certification body auditor performs a third-party audit, not a first-party audit. An accreditation body auditor/assessor evaluates certification bodies or similar conformity assessment bodies, not the organization’s own internal audit program. These are external oversight roles, not first-party audit roles. (ISO)

So the correct answer is:

B, C

ISO 19011 distinguishes the generic competence required of all auditors from the additional leadership competence required of an audit team leader. Planning the audit is a team-leader responsibility because the leader must translate the audit objectives, scope and criteria into an effective sequence of activities and coordinate the team ' s work. Likewise, the team leader must make effective use of audit resources, including available personnel, expertise and time, to ensure that the audit objectives can be achieved efficiently. Sampling, applying a risk-based auditing approach, understanding relevant cultural or social factors and verifying collected information are competencies expected of auditors generally rather than being exclusive to team leaders. The ISO 19011 guidance specifically identifies planning the audit and making effective use of resources as additional audit-team-leader capabilities.

ISO 45001:2018 Clause 9.3.3 states that the outputs of management review shall include decisions related to:

the continued suitability, adequacy and effectiveness of the OH and S management system,

opportunities for continual improvement,

any need for changes to the OH and S management system,

resources needed,

actions, if needed,

opportunities to improve integration of the OH and S management system with other business processes, and

any implications for the strategic direction of the organization.

Based on that, the six correct outputs are:

B. Procurement of new safety harnesses for workers

This is evidence of an action/resource decision arising from management review. It shows management has decided to provide resources or take action to improve OH and S performance.

D. Allocation of a bigger budget for the OHS department

This clearly matches resources needed, which is specifically listed as a management review output.

E. Plan to prioritise health and safety issues as a business strategy

This fits implications for the strategic direction of the organization, which ISO 45001 names as a management review output.

F. Decisions related to continual improvement opportunities

This is almost verbatim from Clause 9.3.3: management review outputs include decisions related to opportunities for continual improvement.

G. Improvements in the OHSMS

This reflects changes needed in the OH and S management system and resulting improvement actions. Where management review decisions lead to system improvements, those improvements are valid output evidence from the review.

J. Opportunities to integrate the OHS management system with other business processes

This is directly stated in Clause 9.3.3 as a required management review output.

Why the other four are not outputs:

A. Report showing the trend of an increase in safety incidents is an input to management review under performance information and trends, not an output.

C. Minutes of previous management reviews are also an input, because management review must consider the status of actions from previous reviews.

H. Worker feedback of positive and negative comments is an input, linked to consultation, participation, and relevant communications.

I. Updates to the risk register may result from actions elsewhere in the system, but they are not specifically identified in ISO 45001 as required management review outputs.

Therefore, the six statements that represent output audit evidence for management review are:

B, D, E, F, G, J

Option A reproduces the ISO management-system definition of an interested party: a person or organisation that can affect, be affected by, or perceive itself to be affected by a decision or activity. This concept is fundamental to ISO 45001 Clause 4.2 because an organisation must determine relevant interested parties and their relevant needs and expectations when establishing its OHSMS context. Examples can include workers, contractors, regulators, suppliers, customers, neighbouring communities and other stakeholders. Options B, C and D alter the defined relationship by substituting terms such as “influence,” “interfere” or limiting the concept to a third party. Those formulations do not match the standardized ISO terminology. The same standardized interested-party wording is published in ISO ' s terminology resources.

ISO 45001 Clause 5.2 explicitly requires the OH and S policy to be available as documented information, making A the correct statement. The policy must include commitments to provide safe and healthy working conditions, fulfil legal and other requirements, eliminate hazards and reduce OH and S risks, continually improve the OHSMS, and consult and ensure participation of workers. However, option B is incomplete because the prescribed commitment is to eliminate hazards and reduce OH and S risks, not merely to reduce risks in isolation. The policy must be communicated within the organisation and be available to interested parties as appropriate; this does not mean automatically supplying it to every conceivable stakeholder. Workers must be aware of the policy, but ISO 45001 does not prescribe formal policy-awareness training for every worker. The policy must also remain appropriate to the organisation ' s purpose, size and context.

An audit trail for evaluating compliance with regulations should focus on the identification, communication, and monitoring of legal and other requirements. Clause 9.1.2 of ISO 45001:2018 requires organizations to evaluate compliance with applicable OH and S legal and other requirements.

Analysis of Options:

A. What is the cost of repairing the wall?Irrelevant to compliance evaluation, as cost considerations are not part of legal compliance.

B. What hazards have been identified as being associated with regulations?Correct. Identifying hazards is a critical step in understanding compliance obligations (Clause 6.1.2).

C. How are maintenance staff made aware of regulatory requirements?Correct. Communication and training are vital for compliance (Clause 7.3).

D. How are OH and S objectives verified?Not directly relevant to compliance evaluations, as objectives pertain to performance improvement.

E. How are OHSMS records of compliance evaluations controlled and managed?Correct. Proper documentation and record-keeping are essential for demonstrating compliance (Clause 7.5).

F. How are updates to OH and S regulations monitored?Correct. Monitoring regulatory changes is critical for maintaining compliance (Clause 6.1.3).

G. How is the cost of safety improvements calculated?Irrelevant to compliance, as cost analysis is not required by ISO 45001.

H. What are the qualifications of the OHS Manager and Maintenance Manager?While competence is important, this does not directly relate to compliance evaluations.

I. What input does the Maintenance Manager have in the determination of legal compliance?Correct. Understanding the roles and responsibilities of key personnel ensures effective compliance (Clause 5.3).

J. What knowledge does the OHS Manager have in relevant safety legislation?Correct. Awareness of applicable legislation is critical for effective compliance evaluation (Clause 7.2).

ISO References:

Clause 9.1.2: Evaluation of compliance.

Clause 6.1.2: Hazard identification and risk assessment.

Clause 7.5: Documented information.

Clause 8.1.2 of ISO 45001 pertains to Eliminating Hazards and Reducing OH and S Risks. Organizations must implement appropriate controls to manage workplace hazards effectively.

Issue Identified:The kitchen environment at the audited site presents multiple hazards, including:

Oil spillage creating a slip hazard.

Open drums of waste material posing a chemical or hygiene hazard.

Unsecured knives and cleavers increasing the risk of cuts.

Boiling water left unattended, posing a risk of burns.

Lack of visible fire extinguishers or fire blankets, increasing fire risk.

Analysis of Options:

A. Failure to reduce risks associated with working in the kitchen.This option accurately captures the broader failure to implement effective measures to eliminate or reduce hazards across multiple areas in the kitchen.

B. Measures to prevent slippage in the kitchen from waste cooking oil were not taken.This is specific to one hazard (oil spillage) and does not address other significant risks observed, such as fire safety or sharp tools.

C. Staff are at risk of serious injury while working in the kitchen.While true, this is more of a general observation and does not address the root cause of the hazards or the failure of controls.

D. Training of the kitchen staff was not effective enough to prevent poor safety awareness in the kitchen area.Although training deficiencies may contribute to the issue, this option does not reflect the overarching systemic failure to manage hazards effectively.

Best Description of the Nonconformance:Failure to reduce risks associated with working in the kitchen (Option A) is the most comprehensive finding, reflecting the organization’s lack of adequate controls to mitigate hazards.

ISO References:

Clause 8.1.2: Organizations must establish controls to eliminate or minimize OH and S risks systematically.

Clause 7.2: Ensuring competency through training is important but must be coupled with hazard control measures.