ISO-45001-Lead-Auditor PECB Certified OHSMS ISO 45001 Lead Auditor Exam Free Practice Exam Questions (2026 Updated)

The correct answers are B. Boundaries of the OHSMS and C. Processes and functions .

In audit terminology, the audit scope describes the extent and boundaries of the audit . This includes matters such as the physical locations, organizational units, activities, processes , and functions being audited. In ISO 45001, the organization is also required to determine the boundaries and applicability of its OH and S management system when establishing its scope under Clause 4.3. Therefore, the boundaries of the OHSMS and the relevant processes and functions are part of audit scope.

Why the other options are not part of the audit scope:

A. Trade union communications may be relevant audit evidence or an issue within worker participation and consultation, but it is not itself a standard way to define the audit scope.

D. Audit checklists are audit preparation tools, not part of the scope.

E. Organisation procedures are usually part of the audit criteria , because auditors compare actual practice against documented procedures.

F. ISO 45001 requirements are also part of the audit criteria , since they are the requirements against which conformity is assessed.

So, the two issues that are part of the audit scope are:

B, C

ISO 45001:2018 requires a holistic approach to occupational health and safety. This means considering all aspects that could impact worker well-being, not just obvious physical hazards. The correct answer encompasses work activities (the tasks themselves), workplace design (the physical environment), and human factors (psychological and social aspects like working hours and harassment). It ' s the most comprehensive and aligned with the standard ' s philosophy

ISO 45001:2018, Clause 6.1.2, outlines requirements for hazard identification . Hazards to consider include work activities, workplace design, human factors, and social factors that may impact OH and S. These go beyond traditional physical risks and include psychosocial and organizational hazards.

Analysis of Options:

A. Work activities, workplace design, and human factors such as hours of work and bullying and harassment: Correct. This comprehensively addresses hazard categories outlined in ISO 45001, Clause 6.1.2.

B. Work activities where there is the possibility of danger: Too general. ISO 45001 includes broader categories of hazards, including those related to organizational and social factors.

C. Hot-work, working at height, enclosed space entry, and work on electrical equipment: Too narrow. These are specific hazards but do not encompass the full range outlined in ISO 45001.

D. Work hazards and environmental factors such as bad weather: Incomplete. While environmental factors are relevant, ISO 45001 also includes workplace design, human factors, and psychosocial hazards.

ISO References:

Clause 6.1.2.1: Hazard identification.

Annex A.6.1.2: Examples of hazard categories, including workplace design and human factors.

Clause 5.2 of ISO 45001:2018 outlines requirements for the OH and S policy, emphasizing commitment to continual improvement, compliance with legal requirements, and communication of the policy to interested parties.

Analysis of Options:

A. The management is committed to health and safety improvement: Correct. The policy explicitly states the organization’s commitment to improvement, meeting Clause 5.2 requirements.

C. The organization has a good reputation for safe experiences: Not relevant to ISO 45001 requirements; reputation is not a policy criterion.

D. The organization intends to communicate its policy to external parties: Correct. Clause 5.2 requires the policy to be communicated to interested parties.

E. The organization is committed to continual health and safety improvement: Correct. This directly aligns with Clause 5.2, which mandates continual improvement.

F. The organization meets all statutory requirements: The policy does not explicitly state compliance with legal requirements, even though this is implied.

G. The organization satisfies its customers’ health and safety requirements: The policy does not specifically address customer requirements.

H. The organization uses contractors committed to health and safety: Not stated in the policy.

I. The organization’s processes deliver the intended improvement to health and safety: This is not evident from the policy statement.

ISO References:

Clause 5.2: OH and S policy.

The best answer is B .

Under ISO 45001, worker consultation and participation is required by Clause 5.4 , but the standard does not require a specific documented procedure for that clause. The organization must provide mechanisms, information, time, training, and resources for consultation and participation, but ISO 45001 does not say it must maintain a formal procedure specifically for this.

Also, ISO 45001 Clause 7.5.3 requires documented information to be controlled so that it is available and suitable for use, and adequately protected. An “obsolete” document is not automatically a nonconformity just because it exists. It may be retained for reference or historical reasons, provided the organization controls it properly and it is not being used unintentionally as current information. That is why the correct audit reaction is to note it and verify on site whether it is actually part of the current controlled documented information .

Why the other options are not the best:

A is weak because using an obsolete procedure to prepare the checklist risks relying on invalid information before confirming what the current controlled version is.

C is unnecessary as the first response. You already have enough evidence to note a potential document-control point and verify it during the audit.

D is incorrect because you should not raise a nonconformity before verifying the facts on site. An obsolete-marked document alone does not prove a breach of Clause 7.5.3. A nonconformity must be based on objective evidence gathered during the audit.

Clause 6.1.2 of ISO 45001:2018 emphasizes the identification of hazards and assessment of risks, and Clause 5.4 highlights the importance of consultation and communication among roles. The auditor ' s role includes verifying conformity to these clauses through evidence gathering and observation.

Analysis of Options:

A. The auditor should advise the organization to get rid of the walled area. This is outside the scope of an auditor’s role, which is to observe and report findings, not to dictate specific actions.

B. The auditor should ask the Maintenance Manager to conduct a safety survey. While safety surveys are useful, asking the Maintenance Manager to conduct one is not the auditor’s responsibility.

C. The auditor should check the lines of communication between the OHS Manager and Maintenance Manager. This aligns with ISO 45001:2018, Clause 5.4, as communication gaps may have contributed to the situation.

D. The auditor should check whether the organization has identified the safety hazards associated with the walled area. Clause 6.1.2 requires hazard identification. The auditor must determine whether this has been done.

E. The auditor should consider surveying more areas of the site for other potentially unsafe situations. Broadening the audit scope to identify additional risks is a good practice in line with Clause 9.2.2.

F. The auditor should demand that the Maintenance Manager deals with the wall. Demanding action is not within the auditor’s authority. The auditor should raise findings instead.

G. The auditor should raise a nonconformity against ISO 45001. While this may be appropriate depending on evidence, raising a nonconformity is not a replacement for good audit practices.

H. The auditor should refer the organization to health and safety authorities. This step is extreme and should only occur if there is an imminent danger and no action is being taken.

ISO References:

Clause 6.1.2: Hazard identification and risk assessment.

Clause 5.4: Worker consultation and participation.

Clause 9.2.2: Internal audit program and execution.

The three correct responses are A, B, and G .

A is correct because ISO 45001 Clause 5.3 requires top management to ensure that the responsibilities and authorities for relevant roles are assigned, communicated and understood at all levels within the organization , and that they are maintained as documented information . So if top management asks whether responsibilities and authorities for relevant roles have to be documented, the correct answer is yes .

B is correct because Clause 5.1 Leadership and commitment requires top management to ensure that the resources needed to establish, implement, maintain and improve the OH and S management system are available . Therefore, the auditor’s “Yes, you do” is correct.

G is correct because Clause 5.1 also requires top management to promote continual improvement . This is stated directly as part of top management leadership and commitment responsibilities under ISO 45001.

Why the others are not correct:

C is incorrect because top management does have to ensure that processes are established for consultation and participation of workers . Clause 5.4 makes this a requirement, so “No, you do not” is wrong.

D is incorrect as written. Top management must establish, implement and maintain the OH and S policy, but ISO 45001 does not state that top management personally has to “write” it. The wording in the option is too specific and not how the standard states the requirement.

E is incorrect because top management does have to ensure that the OH and S management system achieves its intended results. Clause 5.1 says this directly.

F is incorrect because top management must ensure OH and S objectives are established and compatible with the strategic direction, but ISO 45001 does not require top management personally to “write” the objectives.

H is incorrect because the organization must determine the scope under Clause 4.3 , and top management remains accountable for the OH and S management system. Saying “No, you do not” is not correct in this context.

Explanation

Documented information on the organization’s legal requirements → Clause 6.1.3: Clause 6.1.3 requires the organization to identify, document, and maintain compliance obligations, including legal and other requirements relevant to OH and S.

Assessment of OH and S risks → Clause 6.1.2.2: Clause 6.1.2.2 mandates the organization to assess OH and S risks associated with its operations, taking into account hazards, controls, and work activities.

Internal and external issue determination → Clause 4.1: Clause 4.1 requires organizations to determine internal and external issues that affect the OH and S management system and its intended outcomes.

Agreements with the organization’s external providers → Clause 8.1.4.2: Clause 8.1.4.2 pertains to controlling external providers and ensuring their processes align with OH and S requirements, including documented agreements.

References

Clause 4.1: Understanding the organization and its context.

Clause 6.1.2.2: Assessment of risks and opportunities related to OH and S.

Clause 6.1.3: Compliance obligations.

Clause 8.1.4.2: Control of external providers.

Clause 10.2 of ISO 45001 pertains to Nonconformity and Corrective Action . Organizations are required to evaluate incidents, investigate their causes, and implement effective corrective actions to prevent recurrence.

Issue Identified: The incidents in the five old shops are related to VOC emissions from outdated equipment, leading to staff and customer health concerns. This indicates inadequate risk management and failure to act on known safety issues.

Analysis of Options:

A. Display an emergency phone number. This is a reactive approach and does not address the root cause of the issue, i.e., VOC emissions. It also does not align with ISO 45001’s emphasis on preventive measures.

B. Evaluate and update the PPE requirements. While PPE is important, relying solely on PPE without addressing the root cause (emission of VOCs) is insufficient. PPE is considered the last line of defense under the hierarchy of controls.

C. Reassess the OH and S risks associated with the laundry process in the five old shops. This option aligns with ISO 45001, Clause 8.1.2, and Clause 10.2, as it emphasizes reassessing risks and taking steps to mitigate them. A thorough risk assessment could lead to interim measures such as process improvements or administrative controls until the equipment is replaced.

D. Review the current safety procedures. While reviewing safety procedures is useful, it does not address the specific nonconformity related to the equipment’s inability to operate safely.

Best Action: Reassessing the risks in the five shops (Option C) ensures a comprehensive review of the hazards posed by outdated equipment, leading to appropriate preventive and corrective actions.

ISO References:

Clause 10.2: Requires identifying and addressing nonconformities to prevent recurrence.

Clause 8.1.2: Emphasizes the hierarchy of controls and risk assessment as a foundation for mitigating hazards.

Corrections address immediate issues, such as errors or omissions, without addressing root causes. Clause 10.2 of ISO 45001:2018 allows for corrections alongside corrective actions.

Analysis of Options:

A. Adding a missing signature to a corrective action record: Correct. This is a correction addressing an administrative oversight.

B. Changing a process to reduce its inherent risk: Incorrect. This is a corrective action aimed at addressing root causes, not a correction.

C. Changing the name of a tutor that did not deliver a course to the name of the tutor that did: Correct. This corrects an error in records without addressing systemic issues.

D. Reviewing workers’ training records: Incorrect. This is part of ongoing monitoring or auditing, not a correction.

E. Updating the emergency preparedness plan as a result of carrying out a practical test: Incorrect. This is a corrective action resulting from performance evaluation, not a correction.

F. Using OHSMS induction training to address an identified lack of OHSMS awareness among workers: Incorrect. This is a preventive or corrective action, not a correction.

ISO References:

Clause 10.2: Nonconformity and corrective action.

Clause 7.5: Control of documented information

The auditor should assess whether the organization ' s planned action (using masks in case of dust extraction failure) is both implemented and effective. This aligns with ISO 45001 requirements to ensure that control measures are functional and meet the intended objectives.

Clause 8.1.2 (Hierarchy of Controls): The use of PPE, such as masks, is considered a last resort in the hierarchy of controls. The organization must demonstrate that the measure is:

Implemented (e.g., PPE is available and workers are trained to use it).

Effective (e.g., masks provide adequate protection against dust).

Analysis of Options:

A. Advise that the factory should cease operations if the dust extraction equipment malfunctioned. While ceasing operations may be a necessary control in extreme situations, it is not a practical or realistic recommendation unless a high-risk scenario cannot be otherwise managed.

B. Ask the OHSMS Manager to confirm regulatory compliance. Regulatory compliance is important but does not fully address the requirement to ensure the action is effective.

C. Seek evidence that the response action is both implemented and effective. This is the most appropriate response. The auditor must verify implementation and effectiveness to determine conformity.

D. Suggest increasing maintenance checks. Maintenance is important for preventing equipment breakdowns, but this option does not address the immediate audit finding about the adequacy of response actions.

ISO References:

Clause 8.1.2: Emphasizes applying the hierarchy of controls effectively.

Clause 9.1.1: Requires monitoring and measuring controls to ensure effectiveness.

Clause 5.4 of ISO 45001:2018 emphasizes the importance of worker consultation and participation in the OHS management system. It requires organizations to establish processes that ensure workers are actively involved in decision-making and implementation of OHS practices.

Analysis of Options:

A. Promoting collaborating workers to higher positions: While promotions may boost morale, they do not directly contribute to worker consultation and participation in the OHSMS.

B. Appointing worker representatives: This action fosters direct communication and representation of workers ' interests in health and safety matters.

C. Conducting toolbox talks on health and safety: Toolbox talks are an effective way to engage workers in discussing and addressing health and safety issues.

D. Giving ownership of health and safety matters: Involving workers in decision-making and giving them responsibility for specific health and safety tasks encourages participation.

E. Ignoring workers ' suggestions: This undermines consultation and is contrary to ISO 45001 principles.

F. Implementing a payment scheme to reward workers ' OHS performance: While incentives can motivate safe behavior, they are not a consultation or participation mechanism as required by Clause 5.4.

G. Implementing methods for engaging workers: This aligns directly with Clause 5.4, as effective engagement methods (e.g., surveys, focus groups) enhance participation.

H. Threatening reprisals to whistleblowers: This violates ISO 45001 principles and discourages worker participation.

ISO References:

Clause 5.4: Worker consultation and participation.

Clause 5.1: Leadership’s responsibility to foster participation.

The correct answers are E, F .

ISO 45001 Clause 8.1.4.2 Contractors requires the organization to coordinate its procurement processes with its contractors, in order to identify hazards and to assess and control the OH and S risks arising from the contractors’ activities and operations that impact the organization, the organization’s activities and operations that impact the contractors’ workers, and the contractors’ activities and operations that impact other interested parties in the workplace . It also requires the organization to ensure that contractors and their workers meet the organization’s OH and S management system requirements.

In this case, the objective evidence already found during the audit supports the nonconformity:

the hazards list did not include contractor-related hazards;

the Purchase Manager relied on trust rather than controlled OH and S coordination;

the OH and S team said chemical safety had never been a problem, which is not evidence of hazard identification, risk assessment, or control.

The email shown at the closing meeting only states that contractors carry out a site risk assessment . That does not automatically demonstrate that Shelf-Fit itself has met Clause 8.1.4.2 requirements for coordinated procurement control, hazard identification, and control of contractor OH and S risks within its own management system. Therefore, the nonconformity should not simply be withdrawn on the spot.

E. Advise management that the information provided will be reviewed at the audit follow-up stage is acceptable because the auditee can submit corrective-action evidence after the audit. The certification decision and close-out process can consider additional evidence later, but that does not erase the nonconformity already supported by audit evidence gathered during the audit.

F. Note the OHS Manager ' s comments but indicate that there is evidence of a nonconformity that needs to be addressed is also acceptable because this is exactly what the audit team leader should do at the closing meeting: acknowledge the auditee’s response, but maintain the finding where objective evidence supports it.

Why the other options are not acceptable:

A is not appropriate at the closing meeting. The audit team should base findings on evidence gathered within the audit scope and timing, not start a new off-line investigation with contractors at that point.

B is weak audit management. The audit team leader should control the discussion and decision, not hand it over informally.

C is incorrect because the information is not irrelevant; it is relevant, but not sufficient to invalidate the nonconformity.

D is not acceptable because the email does not remove the original evidence of failure in Shelf-Fit’s contractor control process.