ISO-45001-Lead-Auditor PECB Certified OHSMS ISO 45001 Lead Auditor Exam Questions and Answers

Worker participation is a fundamental principle of ISO 45001 (Clause 5.4). It ensures workers at all levels are involved in key activities to enhance the OH and S management system ' s effectiveness.

Analysis of Options:

A. Determining competence requirements:Incorrect. Determining competence is primarily the responsibility of management, though workers may provide input.

B. Establishing OHS objectives:Correct. Worker involvement ensures objectives are realistic and relevant to workplace conditions (Clause 6.2).

C. Managing internal audit programme:Incorrect. Managing audits is typically a managerial responsibility, though workers may participate in audits.

D. Determining actions to eliminate hazards:Correct. Workers’ insights are critical in identifying and implementing actions to eliminate hazards (Clause 8.1.2).

E. Determining what needs to be communicated:Incorrect. While communication strategies impact workers, their participation in determining communication needs is not explicitly required.

F. Establishing OHS policy:Correct. Workers should be involved in developing policies to ensure relevance and buy-in (Clause 5.2).

ISO References:

Clause 5.4: Worker participation.

Clause 6.2: OHS objectives.

Clause 8.1.2: Hierarchy of controls and hazard elimination.

A second-party audit is conducted by a party having an interest in the auditee—most commonly a customer auditing a supplier—or by another competent party acting on that interested party ' s behalf. Consequently, an auditor from a customer may perform the audit, and an external consultant may conduct it on the customer ' s behalf. Auditor training or professional credentials do not, by themselves, determine whether an audit is first-, second- or third-party. By contrast, a certification-body auditor performs independent third-party certification activities, while an accreditation-body auditor assesses conformity-assessment or certification bodies rather than functioning as a customer-side second-party auditor. Therefore, D and F are the two roles that do not correspond to participation in a normal second-party ISO management-system audit. ISO 19011 provides the overarching framework for internal and external management-system audits.

Was he made aware of the hazards related to this work? → Clause 6.1.2.1:Clause 6.1.2.1 focuses on hazard identification. Organizations must identify hazards associated with work activities, such as operating a motorbike, and ensure workers are aware of these hazards.

Was he trained to use the new motorbike? → Clause 7.2:Clause 7.2 requires organizations to ensure that workers are competent to perform their assigned tasks, including providing necessary training for new equipment like a motorbike.

Was he asked to deliver too many orders in a short period of time? → Clause 8.2:Clause 8.2 relates to managing operational controls and ensuring that work processes do not impose undue risks, such as excessive workloads or time pressure.

Was he carrying any contact details in case of an accident? → Clause 7.3:Clause 7.3 requires effective communication of information relevant to OH and S, including emergency contact details or procedures for accidents.

ISO References:

Clause 6.1.2.1: Hazard identification.

Clause 7.2: Competence.

Clause 7.3: Awareness and communication.

Clause 8.2: Operational control.

ISO 45001 requires organizations to identify and maintain documentation to demonstrate compliance with legal and other requirements (Clause 7.5 and Clause 9.1.2). It also requires the evaluation and control of outsourced processes (Clause 8.1.4.3).

Analysis of Options:

A. The park did not have the required documentation to demonstrate compliance with legal requirements:Correct. The outdated and incomplete inspection report (8 years old, lacking detailed identification) fails to demonstrate compliance with health and safety legislation.

B. The organization did not monitor the safety checks by staff of equipment:Incorrect. While there is a potential gap in monitoring, the evidence provided does not directly indicate a lack of monitoring of staff checks.

C. The inspection organization employed by the insurance organization was not evaluated:Correct. ISO 45001 requires the organization to evaluate outsourced services, including those provided by the inspection body, to ensure their adequacy.

D. The park relied on the insurance organization to evaluate its OHS risks:Incorrect. Reliance on external evaluations may not constitute a nonconformity if risks are properly managed, but there is no evidence provided for noncompliance here.

E. Testing to determine the safe loading of equipment was not carried out:Incorrect. While load testing is crucial, there is no evidence presented to confirm this specific issue as a nonconformity.

ISO References:

Clause 7.5: Control of documented information.

Clause 8.1.4.3: Control of outsourced processes.

Clause 9.1.2: Evaluation of compliance.

Hazard: A potential source of harm or adverse health effects.

Risk: The likelihood of harm occurring as a result of the hazard.

Danger: An immediate threat that requires urgent action.

Analysis of Options:

A. Conference room emergency sign directs people to an exit that is no longer available for use (Hazard):Correctly identified as a hazard since it poses a potential risk during emergencies.

B. The carpet on the main staircase is peeling off (Risk):This is a hazard, not a risk, as it represents a source of potential harm.

C. The emergency light in the gift shop did not work when checked (Risk):This is a hazard because it is a condition that could lead to a risk during emergencies.

D. The fire extinguishers in the Natural World area have not been serviced in the last five years (Risk):Correctly identified as a risk because the likelihood of fire-related harm increases without proper servicing.

E. The head of the dinosaur suspended over the main hall has become detached from the rest of the skeleton (Risk):This is a hazard, not a risk, as it represents a potential source of harm.

F. The non-slip mats have been removed from the restaurant (Risk):This is a hazard, not a risk.

G. There is a high possibility of unfit food being sold due to the failure of the oven temperature indicator in the visitors ' restaurant (Hazard):This is a risk because it specifies the likelihood of harm occurring (selling unfit food).

H. There is a water leak next to the electric heater in the admissions area (Danger):Correctly identified as a danger because it represents an immediate and critical threat.

ISO References:

Clause 6.1.2: Hazard identification and assessment of risks and opportunities.

The correct answers are E, F, and H.

This situation raises three serious concerns: impartiality, professional conduct, and the reliability of the audit conclusion. Third-party auditors are expected to act honestly and impartially, and accepting gifts from the auditee is inconsistent with that expectation. The IAF auditor code of conduct says auditors must be honest and impartial and must avoid conduct that discredits the profession. (IAF)

E is correct because the audit team leader must first consider whether the alleged behavior could compromise the validity of the audit findings and conclusion. If that risk is significant, the matter should be escalated to the individual(s) managing the audit programme for direction, since certification audits must remain competent, consistent, and impartial. (ISO)

F is correct because the team leader should gather specific facts and then give the auditor an opportunity to respond to the allegations before deciding the next step. That is the appropriate immediate management action and is consistent with fair handling of an issue that could affect audit integrity. The concern is too serious to ignore, but it should still be examined on evidence, not assumption. (ISO)

H is also correct because, while the matter is being addressed, moving the auditor in training away from the auditor concerned is a sensible control to protect the trainee and the audit process. It helps reduce further disruption and prevents the trainee from being exposed to more inappropriate conduct during the remainder of the audit. This is a practical audit-management response flowing from the team leader’s responsibility to maintain control of the audit team and audit activities. (ISO)

Why the other options are not correct:

A is too immediate and inappropriate. The auditor in training cannot simply replace a qualified auditor without proper competence and authorization being confirmed.

B is premature. The audit should not be terminated immediately without first assessing the facts and the impact on the audit.

C is clearly wrong because the issue could affect the integrity of the current audit and cannot wait until later.

D is wrong and unethical; the tickets should not be accepted by anyone on the audit team. (IAF)

G is wrong because experience does not excuse unethical or unprofessional behavior.

Stage 1 is the readiness and preliminary assessment stage of an initial certification audit. Its purposes include reviewing relevant management-system documented information, assessing site-specific conditions and determining whether the organisation is sufficiently prepared for Stage 2. Any weaknesses that could become nonconformities during Stage 2 can therefore be communicated as areas of concern, making C correct. Option A is incorrect because ISO 19011 provides auditing guidance; the formal two-stage certification requirements are established through ISO/IEC 17021-1. Option B describes the more extensive Stage 2 assessment, where effective implementation and conformity are evaluated. Option D is also incorrect because discussions with client personnel form part of Stage 1 readiness determination. ISO 45001 Lead Auditor training material explicitly identifies Stage 1 areas of concern that could become Stage 2 nonconformities.

Follow-up audits verify that corrective actions have been implemented effectively and address the root cause of the nonconformities.

Analysis of Options:

A. Review the latest emergency response drill report:Correct. This verifies whether emergency response processes are functional and effective.

B. Check if the internal audit schedule was revised:Incorrect. While beneficial, this is not directly related to closing out the nonconformity.

C. Check safety data sheets for completeness:Incorrect. While this ensures compliance, it is not directly related to verifying corrective actions.

D. Check if revised procedures were signed off:Correct. This confirms that changes were properly documented and approved.

E. Determine whether an updated risk assessment was carried out:Correct. Risk assessments confirm the effectiveness of new controls.

F. Inspect areas for safe chemical storage and handling:Correct. Direct observation ensures that corrective actions are implemented effectively.

G. Interview staff on revised emergency procedures:Incorrect. While important, this does not directly address the effectiveness of corrective actions for chemical storage.

H. Interview the OH and S Manager about additional objectives:Incorrect. This is unrelated to the specific nonconformities raised.

ISO References:

Clause 10.2.2: Verification of corrective actions.

Clause 8.1.2: Hazard identification and controls.

Activities following the closure of a third-party audit are generally related to improving the audit process and addressing any unresolved issues.

Analysis of Options:

A. Addressing any audit complaints:Correct. Post-audit, complaints or concerns from stakeholders are addressed to improve the audit process and maintain credibility.

B. Conducting a closing meeting:Incorrect. The closing meeting occurs before the audit is closed.

C. Conducting a review of opportunities for improvement:Correct. Reviewing opportunities for improvement post-audit helps in refining processes and aligning them with organizational goals.

D. Revising the audit ' s objectives:Incorrect. Audit objectives are established during the planning phase, not after the audit has been closed.

E. Updating risks and opportunities to the audit programme:Incorrect. Updates to risks and opportunities occur during ongoing audits, not specifically post-audit.

F. Writing the audit report:Incorrect. The audit report is prepared before the audit is officially closed.

ISO References:

Clause 9.2.2: Audit process review.

ISO 19011:2018, Clause 6.7: Managing complaints and follow-up.

The two options that give the strongest cause for concern are E and F.

E. The oil on the floor might spread to other areas of the kitchen is a clear OH and S concern because the spilled oil already presents a slip hazard in the work area and could increase the risk further if it spreads. ISO 45001 requires the organization to eliminate hazards and reduce OH and S risks through operational control. A spreading oil spill shows inadequate control of a workplace hazard and poor housekeeping in an active kitchen environment.

F. Fire protection may be inadequate without adjacent safety equipment is also a strong concern. In a kitchen with hot oil, boiling water, and multiple ignition sources, the absence of visible fire extinguishers or fire blankets raises concern about the adequacy of emergency preparedness and operational control. ISO 45001 requires organizations to establish processes for emergency preparedness and response, including provision for relevant emergency equipment where needed.

Why the other options are weaker:

A is speculative and refers to the storeroom, even though the immediate issue is the unsafe condition in the kitchen.

B is an assumption about workload, not objective evidence of a system failure.

C may be true, but impurities in waste oil are not the key OH and S issue identified here.

D focuses on whether cleaning arrangements are documented, but ISO 45001 does not require every control to be a documented procedure; the stronger evidence is the unsafe condition itself.

Audit reports should focus on objective evidence, observations, and findings relevant to the management system and the audit process. Personal opinions, unrelated remarks, or derogatory comments are inappropriate.

Analysis of Statements:

A. The guide was trying to be helpful and would not stop talking during the audit:Incorrect. This is irrelevant to the audit findings or conclusions.

B. The Sales Manager was kind and seems to be a nice person:Incorrect. Personal opinions about individuals are not appropriate in audit reports.

C. The audit client’s objectives for this audit were never realistic. That’s why we were unable to complete the audit plan:Correct. This is relevant as it relates to the audit process and highlights challenges in meeting objectives.

D. The maintenance team could not replace a lightbulb, let alone an air conditioning unit:Incorrect. This is derogatory and irrelevant to the audit report.

E. The OHS Management team were extremely helpful and went out of their way to facilitate access to required records:Correct. This is a valid observation about cooperation during the audit process.

F. The OHS Manager disagreed with me in respect of all of the nonconformances I raised. He still does not accept any of them:Incorrect. While disagreements may occur, this statement is overly subjective and not constructive.

G. The Production Manager is lucky to have a job as he does not appear to understand how anything works around here:Incorrect. Personal attacks or irrelevant judgments have no place in the report.

H. The Sales Manager said he had forgotten the password to the Sales Ordering system and so too had everyone else in his department:Correct. This relates to system access and could indicate a nonconformance or an opportunity for improvement.

ISO References:

ISO 19011:2018, Clause 6.7: Reporting audit results.

A-Hazard identification, B-Internal Communication, C-Management review, D-Incidents

ISO 45001 structures the OHSMS around the Plan-Do-Check-Act model. Plan includes identifying hazards, assessing OH and S risks and opportunities, determining requirements, and establishing objectives; therefore, Hazard identification belongs to Plan. Do concerns implementation and operation of the management system, including support processes such as communication, making Internal Communication the correct placement. Check covers monitoring, measurement, internal auditing and management review, so Management review belongs to Check. Act addresses improvement following performance evaluation, including responding to incidents, nonconformities and corrective-action requirements; therefore, Incidents belongs to Act. The mapping reflects the ISO 45001 clause architecture: planning in Clause 6, support/operation in Clauses 7–8, performance evaluation in Clause 9, and improvement in Clause 10.

ISO 45001 requires the organization to adapt the work to workers as part of operational planning and control. Clause 8.1.1(d) states that the organization shall plan, implement, control and maintain the necessary processes, including adapting the work to workers. Annex A.8.1.1 then gives examples, including: redefining how work is organized, redefining processes and work environments, and using ergonomic approaches in the design or modification of workplaces and equipment.

Based on that, D. Providing those who spend the majority of their working days on their computers with frequent breaks is a valid example because it adapts the organization of work to human needs and helps reduce strain and fatigue. This matches the Annex guidance about redefining how work is organized and using ergonomic approaches.

F. Amending a control station to facilitate handicapped workers is also a clear example. ISO 45001 specifically refers to using ergonomic approaches in the design of new workplaces/equipment or in modifying workplaces/equipment. Changing a control station to suit disabled workers is exactly the kind of ergonomic and workplace adaptation the standard is referring to.

G. Amending the start and finish times of processes to accommodate cultural practices is the third valid example, because Annex A.8.1.1 includes the definition or redefinition of how work is organized. Adjusting working times to suit workers’ needs is a direct way of adapting work organization to workers.

Why the others are not the best examples:

A is about competence, which relates more to Clause 7.2 Competence, not adapting work to workers.

B is not appropriate because if workers speak different languages and there are no subtitles, the communication is not being made understandable; ISO 45001 expects information to be comprehensible and identifies language barriers as participation barriers.

C relates to worker participation and consultation, not adapting work to workers.

E is good housekeeping/welfare, but not specifically an example of adapting work to workers in the sense used by ISO 45001 Annex A.8.1.1.

H relates to planning under Clause 6.1, not adapting work to workers.

Therefore, the three actual examples of adapting work to workers are:

D, F, G

The auditor should assess whether the organization ' s planned action (using masks in case of dust extraction failure) is both implemented and effective. This aligns with ISO 45001 requirements to ensure that control measures are functional and meet the intended objectives.

Clause 8.1.2 (Hierarchy of Controls):The use of PPE, such as masks, is considered a last resort in the hierarchy of controls. The organization must demonstrate that the measure is:

Implemented (e.g., PPE is available and workers are trained to use it).

Effective (e.g., masks provide adequate protection against dust).

Analysis of Options:

A. Advise that the factory should cease operations if the dust extraction equipment malfunctioned.While ceasing operations may be a necessary control in extreme situations, it is not a practical or realistic recommendation unless a high-risk scenario cannot be otherwise managed.

B. Ask the OHSMS Manager to confirm regulatory compliance.Regulatory compliance is important but does not fully address the requirement to ensure the action is effective.

C. Seek evidence that the response action is both implemented and effective.This is the most appropriate response. The auditor must verify implementation and effectiveness to determine conformity.

D. Suggest increasing maintenance checks.Maintenance is important for preventing equipment breakdowns, but this option does not address the immediate audit finding about the adequacy of response actions.

ISO References:

Clause 8.1.2: Emphasizes applying the hierarchy of controls effectively.

Clause 9.1.1: Requires monitoring and measuring controls to ensure effectiveness.

The three correct responses are A, B, and G.

A is correct because ISO 45001 Clause 5.3 requires top management to ensure that the responsibilities and authorities for relevant roles are assigned, communicated and understood at all levels within the organization, and that they are maintained as documented information. So if top management asks whether responsibilities and authorities for relevant roles have to be documented, the correct answer is yes.

B is correct because Clause 5.1 Leadership and commitment requires top management to ensure that the resources needed to establish, implement, maintain and improve the OH and S management system are available. Therefore, the auditor’s “Yes, you do” is correct.

G is correct because Clause 5.1 also requires top management to promote continual improvement. This is stated directly as part of top management leadership and commitment responsibilities under ISO 45001.

Why the others are not correct:

C is incorrect because top management does have to ensure that processes are established for consultation and participation of workers. Clause 5.4 makes this a requirement, so “No, you do not” is wrong.

D is incorrect as written. Top management must establish, implement and maintain the OH and S policy, but ISO 45001 does not state that top management personally has to “write” it. The wording in the option is too specific and not how the standard states the requirement.

E is incorrect because top management does have to ensure that the OH and S management system achieves its intended results. Clause 5.1 says this directly.

F is incorrect because top management must ensure OH and S objectives are established and compatible with the strategic direction, but ISO 45001 does not require top management personally to “write” the objectives.

H is incorrect because the organization must determine the scope under Clause 4.3, and top management remains accountable for the OH and S management system. Saying “No, you do not” is not correct in this context.

The correct answer is A. Audit findings that pose a significant health and safety risk.

In management system auditing practice, the audit team leader is expected to maintain communication with the auditee during the audit, especially when serious issues are identified. Where audit evidence indicates a significant risk, this should be communicated without waiting for the closing meeting, so the organization can take prompt action if needed. ISO guidance on conducting audits emphasizes communication during the audit and presentation of findings and conclusions at the closing meeting, while serious risks are handled immediately rather than being delayed. (ISO)

Why the other options are not correct:

B. The outcome of the audit, including the conclusion is normally communicated at the closing meeting, not before it. (Advisera)

C. Diverging opinions within the audit team are internal audit team matters. Only unresolved issues relevant to audit results may be raised appropriately, but internal team differences are not the key information to communicate beforehand.

D. Performance of individual workers when responding to health and safety-related questions is not the purpose of audit reporting. A management system audit evaluates the system and its implementation, not individual worker appraisal.

Therefore, the information that should be communicated to the auditee before the closing meeting is:

A. Audit findings that pose a significant health and safety risk.

The correct answers are D, F, H.

ISO 19011 guidance on generating audit findings says that nonconformities can be graded depending on the context of the organization and its risks. That directly supports D, because any grading should reflect the risk the nonconformity presents to the organization. The same guidance also says this grading can be quantitative (for example 1 to 5) or qualitative (for example minor/major), which makes F correct. Because the wording is “can be graded”, grading is optional rather than mandatory, so H is also true. (Synersia Foundation)

Why the other options are not true:

A is not a requirement in ISO 19011. An organization may define grading rules in its audit programme or procedure, but there is no rule that grading must be agreed with the individual(s) managing the audit programme. (ISO)

B is false. ISO 19011 does not recommend that top management grade nonconformities. Audit findings are generated by auditors based on objective evidence and audit criteria. (ISO)

C is false. A second-party audit team does not have to adopt the auditee’s grading system. The grading approach can follow the auditing organization’s own rules and purpose for the audit. (ISO)

E is false. Additional documented information at the closing meeting does not mean the grading must be changed. The evidence should be reviewed, but unresolved issues may simply remain recorded in the audit report. (Synersia Foundation)

G is false. There is no requirement that extra grading categories must be agreed with the auditee before the closing meeting. The auditee should understand the findings, but the grading framework is not something ISO 19011 requires to be negotiated at that point. (ISO)

The correct answers are B. Boundaries of the OHSMS and C. Processes and functions.

In audit terminology, the audit scope describes the extent and boundaries of the audit. This includes matters such as the physical locations, organizational units, activities, processes, and functions being audited. In ISO 45001, the organization is also required to determine the boundaries and applicability of its OH and S management system when establishing its scope under Clause 4.3. Therefore, the boundaries of the OHSMS and the relevant processes and functions are part of audit scope.

Why the other options are not part of the audit scope:

A. Trade union communications may be relevant audit evidence or an issue within worker participation and consultation, but it is not itself a standard way to define the audit scope.

D. Audit checklists are audit preparation tools, not part of the scope.

E. Organisation procedures are usually part of the audit criteria, because auditors compare actual practice against documented procedures.

F. ISO 45001 requirements are also part of the audit criteria, since they are the requirements against which conformity is assessed.

So, the two issues that are part of the audit scope are:

B, C

The PDCA (Plan-Do-Check-Act) cycle is a core principle of ISO 45001 and many other management systems. It does not include environmental management, as ISO 45001 focuses on Occupational Health and Safety (OH and S), while environmental aspects are covered by ISO 14001.

Analysis of Options:

A. Treatment of Risks:Correct. Risk assessment and control are part of the Plan phase.

B. OHSMS Policy:Correct. The OH and S policy is established in the Plan phase.

C. Environment Management Program:Incorrect. This is outside the scope of ISO 45001 and pertains to ISO 14001.

D. Analyzing OHSMS Performance:Correct. Performance analysis occurs in the Check phase of the PDCA cycle.

ISO Reference:

Clause 0.3: PDCA model in ISO 45001.

ISO 45001 Clause 7.2 Competence requires the organization to:

determine the necessary competence of workers that affect or can affect OH and S performance;

ensure workers are competent, including the ability to identify hazards;

where applicable, take actions to acquire and maintain competence and evaluate the effectiveness of those actions; and

retain appropriate documented information as evidence of competence.

Based on that wording, C is clearly correct because the clause explicitly says workers must be competent, including having the ability to identify hazards. If there is no evidence of that ability, this directly supports a nonconformity against Clause 7.2.

F is also correct because Clause 7.2 requires the organization to determine the competence needed for roles and ensure workers meet it. If there is no evidence that workers’ knowledge and skills are assessed against role requirements, the organization cannot demonstrate that competence has been determined and verified.

H is the third correct answer because Clause 7.2 requires the organization to retain documented information as evidence of competence. Attendance on OH and S training is not, by itself, full proof of competence, but the absence of training records can still support a finding that the organization lacks documented evidence related to competence development and maintenance.

Why the others are not Clause 7.2 findings:

A belongs to Clause 7.3 Awareness, which requires awareness of the consequences of not conforming.

B also relates more to Clause 7.3 Awareness, which includes awareness of the ability to remove themselves from imminent and serious danger.

D is also Clause 7.3 Awareness, because workers must understand their contribution to the effectiveness of the OHSMS.

E relates to consultation and participation under Clause 5.4, not competence.

G refers to quality policy and objectives, which are not ISO 45001 OH and S competence requirements.

Explanation

Documented information on the organization’s legal requirements → Clause 6.1.3:Clause 6.1.3 requires the organization to identify, document, and maintain compliance obligations, including legal and other requirements relevant to OH and S.

Assessment of OH and S risks → Clause 6.1.2.2:Clause 6.1.2.2 mandates the organization to assess OH and S risks associated with its operations, taking into account hazards, controls, and work activities.

Internal and external issue determination → Clause 4.1:Clause 4.1 requires organizations to determine internal and external issues that affect the OH and S management system and its intended outcomes.

Agreements with the organization’s external providers → Clause 8.1.4.2:Clause 8.1.4.2 pertains to controlling external providers and ensuring their processes align with OH and S requirements, including documented agreements.

References

Clause 4.1: Understanding the organization and its context.

Clause 6.1.2.2: Assessment of risks and opportunities related to OH and S.

Clause 6.1.3: Compliance obligations.

Clause 8.1.4.2: Control of external providers.