ISO-45001-Lead-Auditor PECB Certified OHSMS ISO 45001 Lead Auditor Exam Free Practice Exam Questions (2026 Updated)

ISO 45001 Clause 8.1.3 Management of change states that the organization must establish processes for the implementation and control of planned temporary and permanent changes that impact OH and S performance. It also says this includes new products, services and processes, and changes to existing products, services and processes. That makes A true. It also supports B, because the clause is specifically about changes that impact the organization’s OH and S performance.

Statement E is also true. If the organization decides, after an emergency preparedness and response exercise, that it needs to change part of the OHSMS to improve OH and S performance, then that change has to be implemented in a controlled way under the organization’s management-of-change process. ISO 45001 links emergency preparedness with improvement and requires changes impacting OH and S performance to be controlled.

Why the others are false:

C is false because ISO 45001 does not limit management of change to planned changes only. It says the organization must also review the consequences of unintended changes and take action to mitigate adverse effects.

D is false because Clause 8.1.3 does not require retaining documented information of all changes. The clause requires establishing processes for implementation and control, but it does not state a blanket requirement to retain documented information for every change.

F is false because developments in knowledge and technology are explicitly included in management of change, not excluded.

G is false because changes are not limited to those identified by the organization itself; the clause also includes changes in legal and other requirements, and changes in knowledge or information about hazards and risks.

H is false because ISO 45001 explicitly says management of change applies to temporary and permanent planned changes.

Explanation

Documented information on the organization’s legal requirements → Clause 6.1.3:Clause 6.1.3 requires the organization to identify, document, and maintain compliance obligations, including legal and other requirements relevant to OH and S.

Assessment of OH and S risks → Clause 6.1.2.2:Clause 6.1.2.2 mandates the organization to assess OH and S risks associated with its operations, taking into account hazards, controls, and work activities.

Internal and external issue determination → Clause 4.1:Clause 4.1 requires organizations to determine internal and external issues that affect the OH and S management system and its intended outcomes.

Agreements with the organization’s external providers → Clause 8.1.4.2:Clause 8.1.4.2 pertains to controlling external providers and ensuring their processes align with OH and S requirements, including documented agreements.

References

Clause 4.1: Understanding the organization and its context.

Clause 6.1.2.2: Assessment of risks and opportunities related to OH and S.

Clause 6.1.3: Compliance obligations.

Clause 8.1.4.2: Control of external providers.

ISO 19011 distinguishes the generic competence required of all auditors from the additional leadership competence required of an audit team leader. Planning the audit is a team-leader responsibility because the leader must translate the audit objectives, scope and criteria into an effective sequence of activities and coordinate the team ' s work. Likewise, the team leader must make effective use of audit resources, including available personnel, expertise and time, to ensure that the audit objectives can be achieved efficiently. Sampling, applying a risk-based auditing approach, understanding relevant cultural or social factors and verifying collected information are competencies expected of auditors generally rather than being exclusive to team leaders. The ISO 19011 guidance specifically identifies planning the audit and making effective use of resources as additional audit-team-leader capabilities.

According to ISO 45001:2018, the PDCA cycle is explained in Clause 0.4. The Act phase is defined as: taking actions to improve continually the OH and S performance in order to achieve the intended outcomes. This clearly supports C. Making improvements as a correct answer.

Option D. Resetting objectives is also appropriate because ISO 45001 requires OH and S objectives to be reviewed and updated as appropriate. After checking performance results, the organization may revise or reset objectives as part of continual improvement and corrective action. This aligns with the Act stage, where changes are made to improve system effectiveness and performance.

The remaining options belong to other PDCA phases:

A. Verifying training relates more to evaluation of competence and effectiveness, which fits checking activities.

B. Measuring objectives belongs to the Check phase because ISO 45001 says Check includes monitoring and measurement against OH and S policy and objectives.

E. Providing infrastructure belongs to the Do phase because it is part of providing resources and operational support.

F. Auditing processes belongs to the Check phase because internal audits are part of performance evaluation under Clause 9.2.

Therefore, the correct answer is:

C, D

Corrections address immediate issues, such as errors or omissions, without addressing root causes. Clause 10.2 of ISO 45001:2018 allows for corrections alongside corrective actions.

Analysis of Options:

A. Adding a missing signature to a corrective action record:Correct. This is a correction addressing an administrative oversight.

B. Changing a process to reduce its inherent risk:Incorrect. This is a corrective action aimed at addressing root causes, not a correction.

C. Changing the name of a tutor that did not deliver a course to the name of the tutor that did:Correct. This corrects an error in records without addressing systemic issues.

D. Reviewing workers’ training records:Incorrect. This is part of ongoing monitoring or auditing, not a correction.

E. Updating the emergency preparedness plan as a result of carrying out a practical test:Incorrect. This is a corrective action resulting from performance evaluation, not a correction.

F. Using OHSMS induction training to address an identified lack of OHSMS awareness among workers:Incorrect. This is a preventive or corrective action, not a correction.

ISO References:

Clause 10.2: Nonconformity and corrective action.

Clause 7.5: Control of documented information

ISO 45001 requires organizations to identify and maintain documentation to demonstrate compliance with legal and other requirements (Clause 7.5 and Clause 9.1.2). It also requires the evaluation and control of outsourced processes (Clause 8.1.4.3).

Analysis of Options:

A. The park did not have the required documentation to demonstrate compliance with legal requirements:Correct. The outdated and incomplete inspection report (8 years old, lacking detailed identification) fails to demonstrate compliance with health and safety legislation.

B. The organization did not monitor the safety checks by staff of equipment:Incorrect. While there is a potential gap in monitoring, the evidence provided does not directly indicate a lack of monitoring of staff checks.

C. The inspection organization employed by the insurance organization was not evaluated:Correct. ISO 45001 requires the organization to evaluate outsourced services, including those provided by the inspection body, to ensure their adequacy.

D. The park relied on the insurance organization to evaluate its OHS risks:Incorrect. Reliance on external evaluations may not constitute a nonconformity if risks are properly managed, but there is no evidence provided for noncompliance here.

E. Testing to determine the safe loading of equipment was not carried out:Incorrect. While load testing is crucial, there is no evidence presented to confirm this specific issue as a nonconformity.

ISO References:

Clause 7.5: Control of documented information.

Clause 8.1.4.3: Control of outsourced processes.

Clause 9.1.2: Evaluation of compliance.

Clause 9.3 of ISO 45001:2018 outlines the requirements for management reviews. These reviews must evaluate the performance of the OHSMS and identify opportunities for improvement. Outputs of management reviews typically include decisions and actions that align with strategic and operational priorities.

Analysis of Options:

A. Decisions related to continual improvement opportunities:This is a valid output, as continual improvement is a key objective of management reviews under Clause 10.3.

B. Allocation of a bigger budget for the OHS department:Resource allocation is a common output of management reviews to address identified needs.

C. Improvements in the OHSMS:Improvements reflect the organization’s commitment to enhancing safety performance.

D. Minutes of previous management reviews:While minutes provide context, they are not an output of the current management review.

E. Opportunities to integrate the OHS management system with other business processes:Integration opportunities are valid outputs, as they enhance the system ' s effectiveness.

F. Plan to prioritize health and safety issues as a business strategy:Strategic alignment of health and safety with business objectives is an expected output.

G. Procurement of new safety harnesses for workers:This is an operational action, not a direct output of the management review process.

H. Report showing the trend of an increase in safety incidents:This is an input to the management review, not an output.

I. Updates to the risk register:Risk register updates reflect changes in identified hazards and risks, making this a valid output.

J. Worker feedback of positive and negative comments:Worker feedback is an input to the management review, not an output.

ISO References:

Clause 9.3: Management review inputs and outputs.

Clause 10.3: Continual improvement actions.

Clause 8.1.4.2 requires the organisation to coordinate its procurement processes with contractors to identify hazards and assess and control OH and S risks arising from contractor activities and operations. A establishes explicit OH and S requirements within the contractual relationship, creating a controlled mechanism through which Shelf-Fit can specify and enforce relevant safety expectations. B requires contractors to provide site-specific risk-assessment information before work begins, enabling Shelf-Fit to coordinate hazard identification and risk controls proactively rather than relying on contractor expertise or historical absence of incidents. The existing ODT confirms that contractor coordination must cover hazard identification, assessment and control of OH and S risks. Auditing contractors only after incidents is reactive, while chemical retention or merely suggesting training does not establish systematic coordination. ISO 45001 certification of every contractor is also not required by Clause 8.1.4.2.

Clause 5.2 of ISO 45001:2018 outlines requirements for the OH and S policy, emphasizing commitment to continual improvement, compliance with legal requirements, and communication of the policy to interested parties.

Analysis of Options:

A. The management is committed to health and safety improvement:Correct. The policy explicitly states the organization’s commitment to improvement, meeting Clause 5.2 requirements.

C. The organization has a good reputation for safe experiences:Not relevant to ISO 45001 requirements; reputation is not a policy criterion.

D. The organization intends to communicate its policy to external parties:Correct. Clause 5.2 requires the policy to be communicated to interested parties.

E. The organization is committed to continual health and safety improvement:Correct. This directly aligns with Clause 5.2, which mandates continual improvement.

F. The organization meets all statutory requirements:The policy does not explicitly state compliance with legal requirements, even though this is implied.

G. The organization satisfies its customers’ health and safety requirements:The policy does not specifically address customer requirements.

H. The organization uses contractors committed to health and safety:Not stated in the policy.

I. The organization’s processes deliver the intended improvement to health and safety:This is not evident from the policy statement.

ISO References:

Clause 5.2: OH and S policy.

The best responses are D, E, and G.

D. Insist that the nonconformities must stand since there is clear evidence for them apart from the videos is correct because audit findings and nonconformities must be based on objective evidence. If the evidence supporting the findings exists independently of the videos, then the findings should not be rescinded simply because there is a dispute about how supplementary material was recorded. A problem with auditor conduct or site permission does not automatically invalidate valid audit evidence already obtained.

E. Advise the OHS Manager that they should speak to the supervisor to confirm the situation is also appropriate because the auditor stated that permission had been obtained from a supervisor who was part of the safety team. Before taking action, the audit team leader should verify the facts. This is a reasonable and proportionate response to clarify whether site permission was actually granted.

G. Indicate that he, as audit team leader, will seek approval for the taking of videos by auditors at the opening meetings with management at all audits in the future is appropriate because it addresses the control weakness going forward. Audit teams should be clear about site rules, confidentiality, and permissions for photographs or videos before audit activities begin. This is a constructive preventive action for future audits.

Why the other options are not the best:

A may be premature until the facts are verified.

B assumes misconduct before confirming the facts.

C is incorrect because auditors do not inherently “must” take videos.

F is too severe before the situation is properly established and investigated.

H is inappropriate because the audit team leader should not personally handle or manipulate the auditor’s personal phone.

The auditor should assess whether the organization ' s planned action (using masks in case of dust extraction failure) is both implemented and effective. This aligns with ISO 45001 requirements to ensure that control measures are functional and meet the intended objectives.

Clause 8.1.2 (Hierarchy of Controls):The use of PPE, such as masks, is considered a last resort in the hierarchy of controls. The organization must demonstrate that the measure is:

Implemented (e.g., PPE is available and workers are trained to use it).

Effective (e.g., masks provide adequate protection against dust).

Analysis of Options:

A. Advise that the factory should cease operations if the dust extraction equipment malfunctioned.While ceasing operations may be a necessary control in extreme situations, it is not a practical or realistic recommendation unless a high-risk scenario cannot be otherwise managed.

B. Ask the OHSMS Manager to confirm regulatory compliance.Regulatory compliance is important but does not fully address the requirement to ensure the action is effective.

C. Seek evidence that the response action is both implemented and effective.This is the most appropriate response. The auditor must verify implementation and effectiveness to determine conformity.

D. Suggest increasing maintenance checks.Maintenance is important for preventing equipment breakdowns, but this option does not address the immediate audit finding about the adequacy of response actions.

ISO References:

Clause 8.1.2: Emphasizes applying the hierarchy of controls effectively.

Clause 9.1.1: Requires monitoring and measuring controls to ensure effectiveness.