Build your ISO 45001 knowledge, strengthen safety leadership, and support a proactive approach to workplace health and risk management.
An ISO 45001 audit does not fail simply because paperwork is imperfect. Audit findings often reveal a difference between what an organisation's OH&S management system says should happen and what actually happens at the workplace. These gaps matter — they affect employee safety, audit readiness, certification, operational risk and an organisation's ability to demonstrate continual improvement. Recognising the most frequent ISO 45001 nonconformities before an audit can save significant time, cost and disruption.
This guide explains 10 common ISO 45001 audit findings, why they occur and what organisations can do to correct them.
ISO 45001 does not replace national occupational safety legislation. Organisations must comply with the laws applicable in their jurisdiction.
An ISO 45001 nonconformity occurs when an organisation fails to fulfil an applicable requirement of its OH&S management system or the ISO 45001 standard. During an audit, this is identified as a finding, supported by objective evidence — something observed, documented or stated that demonstrates the gap. Once identified, the organisation is expected to implement a correction to address the immediate issue, along with a corrective action to address the root cause and support recurrence prevention.
For the official framework this sits within, see the ISO 45001:2018 official page, which describes ISO 45001 as the international framework for managing OH&S risks and improving OH&S performance.
Organisations often ask about the difference between an ISO 45001 major nonconformity and an ISO 45001 minor nonconformity. It's important to be accurate here: ISO 45001 itself does not provide a universal major/minor classification system. Instead, certification bodies commonly classify audit findings according to their own certification and audit procedures, which can vary between bodies.
Rather than focusing heavily on classification, organisations get more value from understanding the actual ISO 45001 audit findings that arise repeatedly — which is the focus of the rest of this guide.
Relevant area: Clauses 6.1.2.1 and 6.1.2.2
This is one of the most frequent sources of ISO 45001 risk assessment nonconformity and ISO 45001 hazard identification nonconformity findings. A typical example: new equipment, non-routine work or contractor activities are introduced but the risk assessment is not updated. Auditors flag this because it shows the risk-assessment process isn't being kept current, undermining confidence in ISO 45001 risk assessment findings across the system.
Corrective action: Review hazard-identification methodology, reassess affected tasks and ensure risk assessments remain current when work changes.
Relevant areas: Clause 6.1.3 — legal and other requirements; Clause 9.1.2 — evaluation of compliance
This produces ISO 45001 legal compliance nonconformity and broader ISO 45001 compliance gaps. A common example: the legal register exists but has not been updated, or compliance has never been formally evaluated against it — a direct workplace safety compliance failure.
Corrective action: Create a process for identifying applicable occupational safety obligations and periodically evaluating compliance.
Relevant clause: 5.4
This is a recurring source of ISO 45001 worker participation nonconformity and reveals broader occupational health and safety management system gaps. A typical example: risk assessments and incident investigations are completed solely by management without meaningful input from affected workers. Participation matters because workers doing the task often understand the real hazards and practical barriers to safe work better than anyone reviewing procedures on paper.
Corrective action: Build worker consultation into hazard identification, incident investigation, change management and safety decisions.
Relevant clauses: 7.2 — Competence; 7.3 — Awareness
This generates ISO 45001 training nonconformity and ISO 45001 competence nonconformity findings. Common examples include expired training, no competence evidence on file, workers unable to explain emergency procedures, or contractors performing specialist tasks without documented competence.
Corrective action: Identify competence requirements, close skill gaps and retain appropriate evidence.
Relevant clause: 7.5
This is a common ISO 45001 documentation nonconformity, ISO 45001 document control nonconformity and a frequent source of general ISO 45001 audit problems. A typical example: workers use obsolete procedures while the latest version exists only in the management system, meaning what's actually followed on the floor doesn't match what's officially current.
Corrective action: Control approvals, versions, access, distribution, retention and removal of obsolete documents.
The first five findings mainly involve planning, participation, competence and system control. The next five move into operations, contractors, emergencies, auditing and corrective action.
Relevant clauses: 8.1 and 8.1.2
This is a frequent source of ISO 45001 operational control nonconformity, ISO 45001 hazard control issues and broader workplace safety nonconformities. Example: a risk assessment requires machine guarding, lockout controls or fall protection, but observations show those controls are inconsistently implemented.
Corrective action: Compare risk assessments against actual work practices and verify whether controls remain effective.
Relevant clause: 8.1.4
This produces ISO 45001 contractor management nonconformity and wider ISO 45001 compliance issues. Example: contractors begin high-risk activities without sufficient induction, competence verification or risk-control coordination. ISO's 45001 committee notes that outsourced functions must be controlled within the OH&S management system.
Corrective action: Strengthen contractor prequalification, induction, permit systems, competence checks, supervision and performance monitoring.
Relevant clause: 8.2
This is a common source of ISO 45001 emergency preparedness nonconformity and appears frequently among health and safety audit findings. Example: an emergency plan exists but evacuation drills haven't been tested, workers don't know their responsibilities, or lessons from exercises aren't recorded.
Corrective action: Test emergency arrangements regularly and use drill findings to improve procedures.
Relevant clauses: 9.2 — Internal audit; 9.3 — Management review
This generates ISO 45001 internal audit findings, ISO 45001 internal audit nonconformities and ISO 45001 management review nonconformity issues. Possible findings: an audit programme that skips parts of the system, auditors lacking independence, ignored repeat findings, or management reviews that omit significant OH&S performance issues.
Corrective action: Use risk-based internal audits — guided by an ISO 45001 internal audit checklist — and ensure management review produces clear decisions, responsibilities and follow-up actions.
Relevant clause: 10.2
This is one of the most consequential ISO 45001 corrective action issues, tied to ISO 45001 root cause analysis. Consider a finding: "Employees are not wearing required PPE." A weak correction simply states, "Tell employees to wear PPE." A better investigation asks why: unsuitable PPE, poor supervision, inadequate training, supply problems, production pressure, or unclear procedures?
Correcting the immediate problem isn't the same as eliminating its root cause. ISO's Clause 10.2 guidance highlights investigating the event, considering whether similar issues exist elsewhere, and reviewing relevant OH&S risk assessments.
A reliable corrective action process follows this sequence:
This is the audit finding closure process: root cause analysis followed by corrective action verification, not just paperwork closure. Tools like the 5 Whys or fishbone analysis can support root-cause investigation; choose a method appropriate to the problem.
This doubles as a practical ISO 45001 audit checklist and ISO 45001 compliance checklist ahead of certification or surveillance audits.
Professionals wanting a clearer understanding of ISO 45001 requirements, workplace safety responsibilities and OH&S management principles can build that knowledge through our ISO 45001 Occupational Health & Safety Management System Awareness course.
The purpose of addressing ISO 45001 nonconformities is not simply to achieve audit closure. Effective corrective action should improve risk control, worker protection and the OH&S management system. Find the gap, understand the cause, correct the system, verify effectiveness, and prevent recurrence.
