PECB ISO-45001-Lead-Auditor - PECB Certified OHSMS ISO 45001 Lead Auditor Exam

Follow-up audits verify that corrective actions have been implemented effectively and address the root cause of the nonconformities.

Analysis of Options:

A. Review the latest emergency response drill report:Correct. This verifies whether emergency response processes are functional and effective.

B. Check if the internal audit schedule was revised:Incorrect. While beneficial, this is not directly related to closing out the nonconformity.

C. Check safety data sheets for completeness:Incorrect. While this ensures compliance, it is not directly related to verifying corrective actions.

D. Check if revised procedures were signed off:Correct. This confirms that changes were properly documented and approved.

E. Determine whether an updated risk assessment was carried out:Correct. Risk assessments confirm the effectiveness of new controls.

F. Inspect areas for safe chemical storage and handling:Correct. Direct observation ensures that corrective actions are implemented effectively.

G. Interview staff on revised emergency procedures:Incorrect. While important, this does not directly address the effectiveness of corrective actions for chemical storage.

H. Interview the OH and S Manager about additional objectives:Incorrect. This is unrelated to the specific nonconformities raised.

ISO References:

Clause 10.2.2: Verification of corrective actions.

Clause 8.1.2: Hazard identification and controls.

Clause 5.1 of ISO 45001:2018 requires top management to demonstrate leadership and commitment to the OH and S management system. This includes awareness of the OH and S policy and its objectives.

Analysis of Options:

A. As a member of the management team, the Deputy College Principal is not aware of the OHSMS policy:Correct. A lack of awareness of the policy reflects poor leadership commitment, which violates Clause 5.1.

B. OH and S improvement is not possible due to the lack of awareness of the OHSMS:Incorrect. While improvement may be hindered, this is not the main issue in this scenario.

C. The Deputy College Principal is not competent to manage the OHSMS:Incorrect. The Deputy’s competence to manage the OHSMS is not in question; the issue is their lack of awareness of key elements.

D. The OH and S policy only exists as a document in the College Principal’s office:Incorrect. The policy may be accessible but not effectively communicated or understood by management.

ISO References:

Clause 5.1: Leadership and commitment.

Clause 5.2: OH and S policy.

In a first-party audit (internal audit), the organization conducts the audit to determine whether its management system conforms to planned arrangements, to the organization’s own requirements, and to the requirements of ISO 45001, and whether it is effectively implemented and maintained. ISO 45001 Clause 9.2 requires internal audits to provide information on conformity and effectiveness.

E. Verify compliance with regulatory requirements is a valid audit objective because ISO 45001 requires the organization to determine its legal and other requirements and to evaluate compliance with them. Internal audits commonly include verification that these legal OH and S obligations are being met as part of checking the effectiveness and conformity of the OH and S management system. This aligns with Clause 6.1.3 and Clause 9.1.2 of ISO 45001.

B. Complete the audit on time is also an audit objective in practical first-party auditing because audit objectives are established for the audit and supported by planning, resources, timing, and reporting arrangements. While it is not a system conformance criterion, it is a valid objective for the audit assignment itself, ensuring the audit is performed as planned and efficiently managed. This fits normal lead auditor practice in planning and conducting internal audits.

Why the other options are not correct:

A. Apply international standards is too broad and is not itself an audit objective. Standards are the criteria or reference, not the objective.

C. Confirm the scope of the management system is accurate is not usually stated as a first-party audit objective; scope is established by the organization under Clause 4.3, though it may be reviewed during audits.

D. Prepare the audit report for the certification body does not apply to a first-party audit, because internal audits are not performed for a certification body.

F. Update the management policy is a management responsibility, not an audit objective. Audits may identify inputs for policy review, but updating the policy is not the purpose of the audit itself.

Therefore, the two correct options are:

B, E

The correct responses are C and D.

Certification bodies are required to have documented procedures for determining audit time and to determine the time needed to plan and accomplish a complete and effective audit. Audit duration is not something that can simply be shortened because the client asks for less disruption. ISO/IEC 17021-1 requires the certification body to determine audit time through its documented process, and the justification for the duration must be recorded. (IAS)

IAF MD 5 also states that certification bodies shall identify the audit time for each client and that this framework is used within the certification body’s processes to determine the appropriate audit time, taking into account the specifics of the client organization. That means the request may be considered, but it does not have to be accepted. (IAF)

Therefore:

C. Advise that his request will be considered but may not be taken up is correct, because the certification body can review the request, but the final decision must still comply with its audit-time rules and adequacy requirements. (IAF)

D. Advise the OHS Manager that the audit duration and team make-up will be decided in line with the internal procedures of the certification body is correct, because ISO/IEC 17021-1 requires the certification body to use documented procedures for audit time and team decisions. (IAS)

Why the other options are incorrect:

A is inappropriate because the request is not automatically a reason to tell the client to choose another certification body.

B is incorrect because the request cannot simply be accepted without following the certification body’s rules. (IAS)

E is too absolute; the request should be considered against the certification body’s requirements, not rejected automatically. (IAF)

F is unnecessary because the people managing the audit programme already have the responsibility to handle such matters through the certification body’s procedures. (IAS)

The correct answer is D.

ABC states that it has implemented one single OH and S management system for both plants. Once a single management system covers both sites, the certification body has to determine and audit the scope of the management system being operated, not an artificially narrowed commercial scope. IAF MD 1 says a multi-site organization has a single management system, and the certification body must confirm that a single management system is deployed and determine the scope of the management system being operated. It also says the certification document must reflect the scope of certification and the sites/legal entities covered by that multi-site certification. (IAF)

The argument that XYZ is “just a supplier” does not solve the problem. IAF MD 5 makes an important distinction: where an external provider is only a supplier, the certification body audits the organization’s control of the supplied activity, not the performance of the activity itself. But here, XYZ is not outside the management system; ABC has already said both plants are inside one single OHSMS. So XYZ cannot simply be treated as an external supplier for certification-scoping purposes. (IAF)

This is also consistent with the multi-site certification rules that do not allow an organization to exclude covered sites just to avoid certification consequences. IAF MD 1 explicitly says it is not admissible to exclude a problematic site from scope during certification, and the certification documents must show the sites covered by the certified system. While this example is about a “problematic” site, the principle is the same: once the site is part of the single management system, it cannot be carved out simply for convenience or marketing. (IAF)

Therefore, as a third-party auditor, you should not agree to audit only the food plant while ignoring the packaging plant if both are included in the same ISO 45001 management system.

The available audit evidence demonstrates that the organisation has recognised the hazards arising from the equipment change and has implemented an appropriate temporary control: restaurant 2 is closed to the public until replacement equipment is installed and personnel are trained. ISO 45001 Clause 8.1.3 requires organisations to establish processes for implementing and controlling planned temporary and permanent changes that can affect OH and S performance. The auditor should assess conformity against requirements and objective evidence, not criticise legitimate business decisions. There is no evidence that restaurant 2 is operating without required emergency equipment; consequently, raising a legal-compliance nonconformity is unsupported. Nor should the auditor prescribe improved purchasing schedules. The correct audit response is therefore to record the evidence demonstrating controlled management of change and continue with the planned audit trail.