Section one – Five questions worth two marks each – maximum 10

marks

Statements in italics are for reference only and are not part of the expected answer.

1.1 Explain the difference between an ’audit programme’ and an ‘audit plan’

(2 marks)
Typical solution

An audit programme sets out arrangements for a series of audits, such as a

programme for internal audits.

(1 mark)
An audit plan details the arrangements within a specific audit.

(1 mark)

1.2 ISO 45001 requires organisations to determine methods for monitoring and measuring
OH&S performance. Give four examples of typical measures that could be used by an
organisation.

(2 marks)
Typical solution

assessments of compliance with legal requirements and other requirements

the effective use of the results of workplace safety tours or inspections
evaluation of the effectiveness of OH&S training
use of OH&S behaviour based observations
use of perception surveys to evaluate OH&S culture and related employee satisfaction
the effective use of the results of internal and external audits
completion of legally required and other inspections as scheduled
the extent to which planned actions have been implemented
the effectiveness of the employee participation process
the use of health screening
work activity assessments
benchmarking against good OH&S practices

Page 1 of 17
1.3 During an audit of an insurance company an auditor noted that members of staff were using
portable ladders to reach shelves containing files. The highest shelf was 3 metres high. No
assessment of OH&S risks had been carried out for this activity and a non-conformance report
was raised.

Give at least four examples of evidence that could allow the auditor to consider closing
out this non-conformance.

(2 marks)
Typical solution

Risk register showing that relevant hazards have been identified, OH&S risks have now
been assessed and appropriate operational controls have been determined.

Training records showing that all appropriate staff have been made aware and had suitable
training on OH&S issues with respect to use of ladders and working at height and particularly,
the new operational controls in place.

Emails showing that the new operational controls had been communicated to workers’
representatives and other interested parties.

Interviews from a follow up audit visit to the office to verify that all staff are working to
the new operational controls and they are effectively implemented.

1.4 Give at least 4 reasons for an auditor carrying out a documentation review (or stage
one audit).

(2 marks)
Typical solution

Page 2 of 17
 Establishing if the documented information requirements of ISO 45001 have been met.

Assessing an organisation’s readiness for an ISO 45001 audit.

Aiding the planning of an on-site audit.

Allowing the Audit Team Leader to establish whether a topic specialist/expert needs to be
included onto the team.

Determine whether the scope of the audit aligns with the processes covered by the
documentation.

Determine logistics and/or to help with the Stage 2 Plan

1.5 List four reasons why OH&S objectives are an important part of an OHSMS which conforms
to ISO 45001.

(2 marks)
Typical Solution
to maintain and continually improve the OHSMS
to enhance the performance of the OHSMS
to promote a culture which supports the OHSMS
to promote worker participation in the OHSMS
to contribute to the documented information in a OHSMS
To encourage a systematic approach to improvement

Page 3 of 17
 Section two – Four questions worth five marks each – maximum 20
marks

2.1 In your own words and using examples as appropriate, briefly explain the difference
between ‘preventive measures’, ‘correction’ and ‘corrective action’.

(5 marks)

Note: No marks will be awarded for simply quoting the definitions.

Typical solution

Preventive measures are actions taken to address the potential for a

nonconformity to occur. For example, assessment of OH&S risks at the start of a new
project, or preventive maintenance of plant and equipment.

(2 marks)

Correction is action taken to put right what is wrong. An example would be removing a
trip hazard such as a spill of fluid on the floor.

(1 mark)

Corrective action is reactive action taken to address the root cause of a problem to stop it
happening again. For example, using covered or sealed containers to prevent spillage when
being moved.

(2 marks)

2.2 a) Describe the purpose of the opening meeting

(2 marks)

Page 4 of 17
 b) List three items to be considered at the meeting

(3 marks)

Note: For your answer to b), do not repeat any issues mentioned in your answer to a)

Typical solution

a) The purpose of the opening meeting is to confirm the audit plan, introduce the audit team
and ensure that all planned audit activities can be performed.

b) The following items should be considered in an opening meeting as appropriate:

Introduction of the participants

Outline the role of each participant
Confirmation of the audit objectives
Confirmation of the audit scope
Confirmation of the audit criteria
The audit timetable
Any changes to plan
Arrangements for interim meetings
Arrangements for the closing meeting
Sampling methods
Disclaimer or explanation of uncertainty in auditing
Reporting methods
Grading of findings
Reporting language
The role of guides
The role of observers
Communication links

2.3 Outline five items that an audit plan should include.

(5 marks)
Typical solution

Audit scope and objectives – what the audit includes/excludes and the purpose of
the audit.

Audit criteria and reference documents – the requirements conformity is to be determined

against.

Audit timetable – Start and finish times, day, dates etc. for the overall audit.

Audit activities – Location, dates, sequence and expected times and duration of each audit
activity.

Meetings with auditee – Timings for opening and closing meetings with the auditee.
Also, timings for daily review meetings with the auditee.

Meetings with Audit Team – Scheduled auditors’ meetings and methods for team
communication.

Page 5 of 17
Allocation of resources – including the name of the auditor, guides and observers
scheduled to audit each activity.

Reporting – reporting methods, confidentiality, security and reporting

language.

Page 6 of 17
2.4 a) Briefly describe why it is important to contact the auditee prior to an audit. (This might
be the process owner for an internal audit or relevant management for an external audit).

(2 marks)
Typical solution

To confirm arrangements and provide the auditee with an opportunity to ask questions
about the audit process.

To establish the viability of the audit, ensure there are no practical obstacles to the audit
(e.g. factory shutdowns or regulator inspections)

To ensure it is safe to perform the audit and ascertain any site access
requirements (e.g. ID, security clearances etc.)

To ensure a common understanding exists of the purpose and arrangements for the
audit, including its scope and criteria.

To build rapport, introduce yourself and set the scene for the audit.

b) List three topics you would want to discuss when contacting the auditee prior to
the audit.

(3 marks)
Typical solution

Any significant changes to the planned arrangements

General arrangements, contacts and guides, working hours

Page 7 of 17
 Site rules and access – for occupational health and safety arrangements and any personal
protective equipment needed.

Arrangements for opening and closing meeting

The audit plan, timings and duration

Issues from previous audits and corrective action taken

Section three – three questions worth ten marks each – maximum 30

marks

3.1 During a Stage 1 visit to an organisation you note that a construction company, contracted
to repair and maintain the site drainage system, is currently working in the main production
area. The organisation informs you that production is continuing and the production
personnel have to work around the contractor’s activities (which involves removing and
replacing many of the existing drains).

Next month is the Stage 2 audit and you are the lead auditor carrying out the audit.

Explain what you would wish to examine by listing at least 10 issues or audit
checkpoints for investigation making reference to relevant clauses of ISO 45001.

(10 marks)
Typical answer

Adoption of a logical and systematic approach to considering the assessment of OH&S

risk’s, planned actions and controls relating to the construction company’s activities, the
production area, and how the construction is affecting the OH&S related issues of the
production activities. (8.1.4.2)

Has the contracting company been inducted on the OH&S policy and the Occupational
Health and Safety arrangements of the organization? (7.3a, 7.4.3)

Is the construction company working within the organization’s OH&S management system?
(8.1.4.2)

Has the organisation established that the contractors working on the drains are suitably
competent? (7.2b)

Are adequate communication arrangements in place? (7.4.3)

Review the process for the assessment of OH&S risks. Have OH&S risks been reviewed
and revised as appropriate to take into account the effect of the construction company’s
activities. (6.1.2.2)

Has the organisation taken into account relevant legislation/regulations when determining
the controls required? (6.1.4)

Confirm the application of an appropriate process to verify if hazards associated with

this type of construction have been identified (6.1.2.1)

Verify that process(es) for the elimination of hazards and reduction of OH&S risks have
being applied on the work being carried out to date (8.1.1)

Review the arrangements for performance monitoring and measurement.

Page 8 of 17
Do these address the contractor’s activities? (9.1.1a)

Page 9 of 17
 Review the accident/incident statistics. Is there any documented
information to confirm that they have been analysed? (10.2)

Is there any evidence that the risk/operational controls are not effective? (10.2)

If so, do the accident/incident reports for establish of root cause? (10.2)

Examine corrective actions based on investigation reports (10.2)

Look at the process for evaluating effectiveness of corrective actions. (10.2)

Confirm effective Emergency preparedness and response plans are in pace and they have
considered the contractors activities. (8.2)

Confirm communication of the OH&S Policy with contractors (5.2)

3.2 You are conducting a third-party, ISO 45001 audit of a food processing company, focussing
on their internal audit process.

You determine that the organisation’s occupational health and safety system internal
audit programme has been the same for the past four years. Each department is audited
once every year and audit objectives have been limited to checking that the operational
controls are carried out as described in documented information.

a) There are two requirements of ISO 45001 clause 9.2 that are unlikely to be met based
on what you have determined so far. Describe these two requirements.

(4 marks)

b) List three topics that you would want to discuss with the audit programme manager
during your audit. For each topic, briefly outline what you would want to discuss and
why. State the applicable clauses of ISO 45001 as appropriate.
(6 marks)
Typical solution

a) The two ISO 45001 requirements that are unlikely to be met are:

Page 10 of 17
 1. The audit programme appears not to take into consideration the importance of
the processes concerned and the results of previous audits (9.2.2.a).
(2 marks)

2. Audits appear to focus on conformity (9.2.1a) and do not appear to determine

whether the OH&S Management system is properly implemented and maintained (9.2.1b).
(2 marks)

b) Agenda topics
Criteria for developing the audit programme (9.2.2). To assess the basis for deciding on
the current programme and whether the importance of the processes concerned and the
results of previous audits are a consideration.

Results of previous audits (9.2.2). To determine if planned audits have been completed.
Has there been any analysis of the results? Are there any poorly performing areas,
departments or processes?

Results of performance measurement and monitoring (9.1.1). To assess whether the

information would suggest that auditing of certain processes and areas should be more
frequent than others.

Incident investigation (10.2). To assess if the investigations indicates areas of weakness or

opportunities for improvement that should be considered when planning and conducting
internal audits.

Corrective actions resulting from audit findings (9.2 and 10.2). Have these been effectively
addressed and verified as effectively implemented with no evidence of recurrence?

Management review (9.3). Are audit results discussed at the management review? What
actions have resulted from review?

Auditor Competence and training (7.2). To determine if competence requirements have

been determined for the audit programme manager and auditors and if the necessary training
has been given.

3.3 a) Explain, in your own words, the difference between a “hazard” and an “OH&S risk” in an
OHSMS.

(2 marks)
Typical Solution
A hazard in a OHSMS is a situation which could or does result in unintended
injury or ill health in an organisation.

An OH&S risk in a OHSMS is the degree to which a hazard is likely to cause injury or ill
health associated with the level of its severity.

b) You are conducting a OHSMS audit in the warehouse of a large distribution

company working mainly in the online market for books and other publications. From an
overhead gantry, you observe that there are a number of diesel powered fork lift trucks
moving around the floor area which has pallet storage racks four levels high. A number of
people are pushing trolleys along the passageways. You have noted that more safety
incidents took place in this area in the last year than in any other area.

Page 11 of 17
Describe four hazards and their potential consequences in the warehouse which you would
expect to have been identified as part of their risk management process.
(4 marks)
Typical Solution

Moving vehicles (hazard) may collide with workers (consequence)

Page 12 of 17
 Diesel emissions (hazard) can cause respiratory problems for workers (consequence)

Noise (hazard) from the trucks which can cause hearing problems for workers
(consequence)

Poorly located pallets (hazard) which may fall from their racks and cause injury
(consequence)

Over extended forks (hazard) which may cause the truck or its load to imbalance especially
at height and cause injury (consequence)

Vehicles being driven too fast (hazard) which can cause loads to fall off and cause injury
(consequence)

Exceeding the safe load of racking/shelving (hazard) – this could lead to collapse, and falling
objects injuring personnel (consequence)

Manual handling operations (hazard) – can lead to strain injuries (consequence)

Spillage of liquid or debris on the floor (hazard) - could lead to slips and trip injuries
(consequence)

c) Outline four opportunities for OH&S improvement which might eliminate these hazards and
reduce OH&S risks.

(4 marks)
Typical Solution

Replace fork lift trucks with automated materials control systems

Page 13 of 17
Replace diesel trucks with battery powered vehicles with no exhaust emissions

Reduce noise by employing quieter electric vehicles

Install a warning system for detecting incorrectly located pallets

Fit a limiter to prevent over-extending of loads and forks

Fit speed limiters to the truck engines

Introduce mechanical lifting equipment

Implementation of regular housekeeping inspections

Better safety signage

Separation of vehicle and pedestrian traffic, clearly marked walkways, barriers

Section four – three questions worth 10 marks each – maximum 30 marks

4.1 – Audit situation one:

During an audit of a company that refurbishes computers, you notice a new Spray Booth has
been built for use when painting small parts. It uses Aerosol Spray Cans. This activity used
to be sub-contracted overseas, but has now been brought ‘in house’.

You observe the spraying being carried out and note that there is a strong smell of
solvent even though the fans in the spray booths are operating. You note from the paint
material safety data sheet that the paint fumes are harmful and ask if an assessment of
OH&S risks has been carried out for this activity. The Manager replies stating that was not
necessary as the aerosol spray paint and the booths are similar to those used by the overseas
sub-contractor so the hazards are well established. The operators have access to face masks.

Your audit trail leads you to the accident and incident records and you note that there
have been recent reports of personnel complaining about ‘stinging’ eyes and slight
difficulties in breathing. The action taken was to instruct operators not to put their heads too
far into the spray booth when spraying.

Solution – Nonconformity

OHSMS AUDIT - NONCONFORMITY REPORT 1

Nonconformity (2 marks for identifying the scenario as a nonconformity)

Description of the nonconformity (3 marks for identifying the failure)

The recent implementation of spraying small components has not been subject to an
assessment of OH&S risks. Harmful fumes from the paint process are not being extracted
away from workers effectively, causing health issues.

Evidence (3 marks for identifying the vidence)

Accident and incident records indicate that the health of workers is being harmed by the
vapours generated by the spraying activities. No assessment of OH&S risks has been

Page 14 of 17
 conducted. Operational control of the process in the spray booth is not suitably effective to
prevent harm.

ISO 45001 clause and equirement:

6.1.2.2 – “The organization shall establish, implement and maintain a process(es) to a)
assess OH&S risks from identified hazards while taking into account the effectiveness of
existing controls”

OR

8.1.3 – “The organization shall establish a process(es) for the implementation and control of
planned temporary and permanent changes that impact OH&S performance. Note changes
can result in risks and opportunities”

OR

9.1.1a.4 – “The organization shall establish, implement and maintain a process(es) for
monitoring, measurement, analysis and performance evaluation. The organization shall
determine effectiveness of operational and other controls”.

4.2 Audit situation two:

You are auditing an organisation that delivers sandwiches to offices by a fleet of small
vans on a daily basis. You note that, over the past twelve months, there has been a
twenty-five percent increase in ‘near misses’ for road traffic accidents recorded by the six
employees.

You are provided with a verbal explanation as to how the incident reporting process
operates. The auditee further advises you that although this process is not maintained as
documented information, all six employees know how to report and record incidents,
including any near misses, as it is covered in the induction training.

You ask about the cause of the increase in near misses and are told “there are no special
reasons; we can go for a while without any and then we get quite a few in a short
period”.

Solution – No nonconformity

Audit investigation 2 There is insufficient evidence

for a nonconformity.
Whilst an increase in near miss reporting may indicate an increase in near misses, it may just
indicate a better awareness of near misses and/or when to report them. There is no
requirement to maintain documented information which details the process for reporting
incidents.

There is also cause to raise a concern about lack of suitable performance measurement and
monitoring and analysis. More evidence is required.
(2 marks)
Points of investigation and evidence sought:

Page 15 of 17
Establish if there has been a campaign to increase awareness of near misses and how
to report them (6.2.1).
(2 marks)
Review the assessment of OH&S risks for driving (6.1.2.2).
(2 marks)

Page 16 of 17
 Ask if the driver’s routes/work load have changed that may account for an increase in near
misses and assess whether any changes have been made to the assessment of OH&S risks
or operational controls (6.1.2.1) or (8.1.1).
(2 marks)
Review the methods of communicating processes and establish if staff do understand how
to report incidents and near misses (7.4.2).
(2 marks)
Establish if there is a process in place for gathering, recording, analysing and acting upon
near miss data (9.1.1).
(2 marks)

4.3 Audit situation three:

During a site visit for a stage 2 certification audit of a facility management company, you
notice that a window cleaner is stretching from a long ladder to clean a window pane on the
second floor. The ladder is resting on loose chippings. There is no indication that the ladder
is secured and the cleaner is unaccompanied. He is not wearing a safety harness and is
working with a bucket perched on the top rung of the ladder.

You discuss this situation with the OH&S Manager who states that the operator works for a
subcontractor, EasyClean. He adds that they have also used this subcontractor for many
years to service their own clients. He tells you that he has visited the contractor’s offices to
discuss OH&S issues and was satisfied with their level of awareness of their responsibilities.
He mentions that he will have a word with the operator about safety practices when using
ladders.

Solution – Nonconformity

OHSMS AUDIT - NONCONFORMITY REPORT 3

Nonconformity (2 marks for identifying the scenario as a nonconformity)

Description of the nonconformity (3 marks for identifying the failure)

A contractor’s operator working on site did not demonstrate awareness of the hazards and
risks associated with the work being undertaken by failing to take the necessary safety
precautions.

Evidence (3 marks for identifying the evidence)

The window cleaner’s ladder was not anchored at the top or bottom, representing an unsafe
platform. The operator was not using personal protective equipment (PPE), e.g. a harness,
which could prevent a fall from height. The operator was over-reaching, thereby risking
overbalancing. There was no person guarding the foot of the ladder to direct people around
it.

ISO 45001 clause and requirement:

7.3.e – “Workers shall be made aware of hazards, OH&S risks and actions determined that
are relevant to them”.

Page 17 of 17