Internal audits are a rehearsal, not a test. The certificate depends on the same handful of questions being answered convincingly every time — and the answers depend on your records being findable. Here are the twelve questions that come up in nearly every ISO 45001 audit, and what to have ready.
Leadership and worker participation
- "Show us the minutes from your last management review." — Have objectives, trends and decisions in one document.
- "How do workers contribute to the OH&S management system?" — Keep toolbox talks, observations and hazard reports signed and timestamped.
- "Who is the management representative?" — Name them, and prove their decisions have follow-through.
Risk and the controls you claimed
- "Show the risk assessment for this task." — Current version, with the review date visible.
- "How did this risk score change after the control?" — A risk matrix that records before and after is the cleanest answer.
- "What are the legal obligations for this site?" — A compliance register with renewal dates beats a folder of PDFs.
Incidents, findings and CAPA
- "Walk us through your last incident." — Investigation notes, root cause, actions, verification — all attached to one record.
- "Where are the corrective actions from the last audit?" — Every finding should link to a CAPA with an owner and a closed date.
- "Are actions actually verified?" — Close-outs with evidence, not just a checkbox.
Training and competence
- "Show training records for the forklift operators." — Competence profiles per person, with expiry dates visible.
- "What happens when a certificate lapses?" — Automatic reminders, so the answer is never "we didn't notice."
The pattern is simple: every question is about a record, and every record should be findable in under a minute. That's the whole job. If an auditor has to ask twice, the management system isn't working yet.