PECB ISO-45001-Lead-Auditor - PECB Certified OHSMS ISO 45001 Lead Auditor Exam

The correct answer is A. Audit findings that pose a significant health and safety risk.

In management system auditing practice, the audit team leader is expected to maintain communication with the auditee during the audit, especially when serious issues are identified. Where audit evidence indicates a significant risk, this should be communicated without waiting for the closing meeting, so the organization can take prompt action if needed. ISO guidance on conducting audits emphasizes communication during the audit and presentation of findings and conclusions at the closing meeting, while serious risks are handled immediately rather than being delayed. (ISO)

Why the other options are not correct:

B. The outcome of the audit, including the conclusion is normally communicated at the closing meeting, not before it. (Advisera)

C. Diverging opinions within the audit team are internal audit team matters. Only unresolved issues relevant to audit results may be raised appropriately, but internal team differences are not the key information to communicate beforehand.

D. Performance of individual workers when responding to health and safety-related questions is not the purpose of audit reporting. A management system audit evaluates the system and its implementation, not individual worker appraisal.

Therefore, the information that should be communicated to the auditee before the closing meeting is:

A. Audit findings that pose a significant health and safety risk.

The correct answers are E, F, and H.

This situation raises three serious concerns: impartiality, professional conduct, and the reliability of the audit conclusion. Third-party auditors are expected to act honestly and impartially, and accepting gifts from the auditee is inconsistent with that expectation. The IAF auditor code of conduct says auditors must be honest and impartial and must avoid conduct that discredits the profession. (IAF)

E is correct because the audit team leader must first consider whether the alleged behavior could compromise the validity of the audit findings and conclusion. If that risk is significant, the matter should be escalated to the individual(s) managing the audit programme for direction, since certification audits must remain competent, consistent, and impartial. (ISO)

F is correct because the team leader should gather specific facts and then give the auditor an opportunity to respond to the allegations before deciding the next step. That is the appropriate immediate management action and is consistent with fair handling of an issue that could affect audit integrity. The concern is too serious to ignore, but it should still be examined on evidence, not assumption. (ISO)

H is also correct because, while the matter is being addressed, moving the auditor in training away from the auditor concerned is a sensible control to protect the trainee and the audit process. It helps reduce further disruption and prevents the trainee from being exposed to more inappropriate conduct during the remainder of the audit. This is a practical audit-management response flowing from the team leader’s responsibility to maintain control of the audit team and audit activities. (ISO)

Why the other options are not correct:

A is too immediate and inappropriate. The auditor in training cannot simply replace a qualified auditor without proper competence and authorization being confirmed.

B is premature. The audit should not be terminated immediately without first assessing the facts and the impact on the audit.

C is clearly wrong because the issue could affect the integrity of the current audit and cannot wait until later.

D is wrong and unethical; the tickets should not be accepted by anyone on the audit team. (IAF)

G is wrong because experience does not excuse unethical or unprofessional behavior.

The correct answers are E, F.

ISO 45001 Clause 8.1.4.2 Contractors requires the organization to coordinate its procurement processes with its contractors, in order to identify hazards and to assess and control the OH and S risks arising from the contractors’ activities and operations that impact the organization, the organization’s activities and operations that impact the contractors’ workers, and the contractors’ activities and operations that impact other interested parties in the workplace. It also requires the organization to ensure that contractors and their workers meet the organization’s OH and S management system requirements.

In this case, the objective evidence already found during the audit supports the nonconformity:

the hazards list did not include contractor-related hazards;

the Purchase Manager relied on trust rather than controlled OH and S coordination;

the OH and S team said chemical safety had never been a problem, which is not evidence of hazard identification, risk assessment, or control.

The email shown at the closing meeting only states that contractors carry out a site risk assessment. That does not automatically demonstrate that Shelf-Fit itself has met Clause 8.1.4.2 requirements for coordinated procurement control, hazard identification, and control of contractor OH and S risks within its own management system. Therefore, the nonconformity should not simply be withdrawn on the spot.

E. Advise management that the information provided will be reviewed at the audit follow-up stage is acceptable because the auditee can submit corrective-action evidence after the audit. The certification decision and close-out process can consider additional evidence later, but that does not erase the nonconformity already supported by audit evidence gathered during the audit.

F. Note the OHS Manager ' s comments but indicate that there is evidence of a nonconformity that needs to be addressed is also acceptable because this is exactly what the audit team leader should do at the closing meeting: acknowledge the auditee’s response, but maintain the finding where objective evidence supports it.

Why the other options are not acceptable:

A is not appropriate at the closing meeting. The audit team should base findings on evidence gathered within the audit scope and timing, not start a new off-line investigation with contractors at that point.

B is weak audit management. The audit team leader should control the discussion and decision, not hand it over informally.

C is incorrect because the information is not irrelevant; it is relevant, but not sufficient to invalidate the nonconformity.

D is not acceptable because the email does not remove the original evidence of failure in Shelf-Fit’s contractor control process.

ISO 45001 Clause 5.2 OH and S policy requires top management to establish, implement and maintain an OH and S policy that includes a commitment to provide safe and healthy working conditions, fulfill legal and other requirements, and achieve continual improvement of the OH and S management system. It also requires the policy to be communicated within the organization and to be available to interested parties, as appropriate.

B. The management is committed to health and safety improvement is correct because the policy states: “Continual health and safety improvement is a permanent objective of the organisation.” That clearly demonstrates commitment to improvement, which aligns with Clause 5.2.

C. The organisation intends to communicate its policy to external parties is correct because the policy says: “Where required, the policy shall be communicated to all interested parties.” This matches the ISO 45001 requirement that the OH and S policy be available to interested parties, as appropriate.

G. The organisation is committed to continual health and safety improvement is also correct because the statement explicitly says: “Continual health and safety improvement is a permanent objective of the organisation.” This directly reflects the requirement for continual improvement in the OH and S policy.

Why the other options are not supported by the policy statement:

A is not correct because the policy expresses intent to work in accordance with regulations, but it does not prove the organization meets all statutory requirements in practice.

D is not correct because the policy does not provide evidence of reputation.

E is not correct because the policy does not prove that processes actually deliver improvement; it only states commitment.

F is not correct because the policy mentions contractors, but it does not prove that contractors themselves are committed to health and safety.

H is not correct because the policy mentions safe experiences and customers, but it does not prove that customer health and safety requirements are satisfied.

Therefore, the three options for which the organization is meeting ISO 45001 policy requirements are:

B, C, G

A first-party audit is an internal audit. In ISO management system auditing terminology, first-party audits are performed by, or on behalf of, the organization itself to evaluate its own management system. Therefore, E. Internal audit is directly correct.

A first-party audit can also be carried out as a process audit when the organization audits one of its own processes to determine whether it is planned, implemented, maintained, and effective. Since internal audits under ISO 45001 are planned and conducted over processes, functions, and areas within the OH and S management system, D. Process audit also applies.

Why the other options are not correct:

A. Certification audit is a third-party audit, carried out by a certification body, not a first-party audit.

B. Surveillance audit is also a third-party certification body activity conducted after certification.

C. Regulatory audit is performed by a regulator or authority, not by the organization on itself.

F. External audit does not describe a first-party audit, because first-party audits are internal by definition.

Therefore, the two phrases that apply to a first-party audit are:

D, E

Was he made aware of the hazards related to this work? → Clause 6.1.2.1:Clause 6.1.2.1 focuses on hazard identification. Organizations must identify hazards associated with work activities, such as operating a motorbike, and ensure workers are aware of these hazards.

Was he trained to use the new motorbike? → Clause 7.2:Clause 7.2 requires organizations to ensure that workers are competent to perform their assigned tasks, including providing necessary training for new equipment like a motorbike.

Was he asked to deliver too many orders in a short period of time? → Clause 8.2:Clause 8.2 relates to managing operational controls and ensuring that work processes do not impose undue risks, such as excessive workloads or time pressure.

Was he carrying any contact details in case of an accident? → Clause 7.3:Clause 7.3 requires effective communication of information relevant to OH and S, including emergency contact details or procedures for accidents.

ISO References:

Clause 6.1.2.1: Hazard identification.

Clause 7.2: Competence.

Clause 7.3: Awareness and communication.

Clause 8.2: Operational control.

Clause 9.3 of ISO 45001:2018 outlines the requirements for management reviews. These reviews must evaluate the performance of the OHSMS and identify opportunities for improvement. Outputs of management reviews typically include decisions and actions that align with strategic and operational priorities.

Analysis of Options:

A. Decisions related to continual improvement opportunities:This is a valid output, as continual improvement is a key objective of management reviews under Clause 10.3.

B. Allocation of a bigger budget for the OHS department:Resource allocation is a common output of management reviews to address identified needs.

C. Improvements in the OHSMS:Improvements reflect the organization’s commitment to enhancing safety performance.

D. Minutes of previous management reviews:While minutes provide context, they are not an output of the current management review.

E. Opportunities to integrate the OHS management system with other business processes:Integration opportunities are valid outputs, as they enhance the system ' s effectiveness.

F. Plan to prioritize health and safety issues as a business strategy:Strategic alignment of health and safety with business objectives is an expected output.

G. Procurement of new safety harnesses for workers:This is an operational action, not a direct output of the management review process.

H. Report showing the trend of an increase in safety incidents:This is an input to the management review, not an output.

I. Updates to the risk register:Risk register updates reflect changes in identified hazards and risks, making this a valid output.

J. Worker feedback of positive and negative comments:Worker feedback is an input to the management review, not an output.

ISO References:

Clause 9.3: Management review inputs and outputs.

Clause 10.3: Continual improvement actions.

Analysis of Options:

A. Results of management review:Correct. Clause 9.3 requires retention of management review results as documented information.

B. Risks and opportunities:Incorrect. Risks and opportunities must be considered and managed, but retaining this as documented information is not mandatory.

C. Results of compliance evaluation:Correct. Clause 9.1.2 requires retention of compliance evaluation results.

D. Workers ' current level of competency:Incorrect. Competency must be ensured, but retaining specific competency records is not explicitly required.

E. Assigned responsibilities and authorities:Incorrect. These must be defined and communicated but are not required to be retained as documented information.

F. The relevant requirements of workers:Incorrect. Relevant worker requirements must be considered but not retained as documented information.

G. Effectiveness of corrective actions:Correct. Clause 10.2 requires retention of evidence of corrective actions taken.

H. OH and S Policy:Correct. Clause 5.2 requires the OH and S policy to be maintained as documented information.

ISO References:

Clause 5.2: OH and S policy.

Clause 9.1.2: Compliance evaluation.

Clause 9.3: Management review.

Clause 10.2: Corrective actions.