Pass the PECB ISO 45001 ISO-45001-Lead-Auditor Questions and answers with Dumpstech

A second-party audit is conducted by a party having an interest in the auditee—most commonly a customer auditing a supplier—or by another competent party acting on that interested party ' s behalf. Consequently, an auditor from a customer may perform the audit, and an external consultant may conduct it on the customer ' s behalf. Auditor training or professional credentials do not, by themselves, determine whether an audit is first-, second- or third-party. By contrast, a certification-body auditor performs independent third-party certification activities, while an accreditation-body auditor assesses conformity-assessment or certification bodies rather than functioning as a customer-side second-party auditor. Therefore, D and F are the two roles that do not correspond to participation in a normal second-party ISO management-system audit. ISO 19011 provides the overarching framework for internal and external management-system audits.

The three correct responses are A, B, and G.

A is correct because ISO 45001 Clause 5.3 requires top management to ensure that the responsibilities and authorities for relevant roles are assigned, communicated and understood at all levels within the organization, and that they are maintained as documented information. So if top management asks whether responsibilities and authorities for relevant roles have to be documented, the correct answer is yes.

B is correct because Clause 5.1 Leadership and commitment requires top management to ensure that the resources needed to establish, implement, maintain and improve the OH and S management system are available. Therefore, the auditor’s “Yes, you do” is correct.

G is correct because Clause 5.1 also requires top management to promote continual improvement. This is stated directly as part of top management leadership and commitment responsibilities under ISO 45001.

Why the others are not correct:

C is incorrect because top management does have to ensure that processes are established for consultation and participation of workers. Clause 5.4 makes this a requirement, so “No, you do not” is wrong.

D is incorrect as written. Top management must establish, implement and maintain the OH and S policy, but ISO 45001 does not state that top management personally has to “write” it. The wording in the option is too specific and not how the standard states the requirement.

E is incorrect because top management does have to ensure that the OH and S management system achieves its intended results. Clause 5.1 says this directly.

F is incorrect because top management must ensure OH and S objectives are established and compatible with the strategic direction, but ISO 45001 does not require top management personally to “write” the objectives.

H is incorrect because the organization must determine the scope under Clause 4.3, and top management remains accountable for the OH and S management system. Saying “No, you do not” is not correct in this context.

A pre-audit documented-information review provides intelligence needed to prepare an effective, risk-based audit. It can identify higher-risk areas requiring greater audit attention, verify the defined OHSMS scope, help confirm whether the planned audit team ' s size and collective competence are adequate, and develop a clearer understanding of the auditee ' s processes and activities. These are direct planning benefits. The review does not automatically justify shortening the total audit duration or reducing interviews; sufficient audit time and evidence must still be obtained. Nor is the purpose to retain auditee-controlled emergency documentation after the audit. ISO 19011 ' s documented-information-review guidance emphasizes understanding the auditee ' s operations, preparing audit activities, identifying possible areas of concern and taking account of scope, organisational size, complexity, risks and opportunities.

The correct answer is D.

ABC states that it has implemented one single OH and S management system for both plants. Once a single management system covers both sites, the certification body has to determine and audit the scope of the management system being operated, not an artificially narrowed commercial scope. IAF MD 1 says a multi-site organization has a single management system, and the certification body must confirm that a single management system is deployed and determine the scope of the management system being operated. It also says the certification document must reflect the scope of certification and the sites/legal entities covered by that multi-site certification. (IAF)

The argument that XYZ is “just a supplier” does not solve the problem. IAF MD 5 makes an important distinction: where an external provider is only a supplier, the certification body audits the organization’s control of the supplied activity, not the performance of the activity itself. But here, XYZ is not outside the management system; ABC has already said both plants are inside one single OHSMS. So XYZ cannot simply be treated as an external supplier for certification-scoping purposes. (IAF)

This is also consistent with the multi-site certification rules that do not allow an organization to exclude covered sites just to avoid certification consequences. IAF MD 1 explicitly says it is not admissible to exclude a problematic site from scope during certification, and the certification documents must show the sites covered by the certified system. While this example is about a “problematic” site, the principle is the same: once the site is part of the single management system, it cannot be carved out simply for convenience or marketing. (IAF)

Therefore, as a third-party auditor, you should not agree to audit only the food plant while ignoring the packaging plant if both are included in the same ISO 45001 management system.

The correct answer is C. Planning the Occupational Health and Safety policy.

ISO 45001 explicitly identifies several planning activities across Clauses 4 to 10. For example, Clause 6.1.4 requires the organization to plan actions to address risks and opportunities, legal requirements and other requirements, and to prepare for and respond to emergency situations. This means A and D are both genuine planning activities named in the standard.

ISO 45001 also identifies planning, establishing, implementing and maintaining audit programmes in Clause 9.2.2, so B. Planning an audit programme is clearly a planning activity within the requirements.

By contrast, the OH and S policy is covered in Clause 5.2 Policy. The standard requires top management to establish the OH and S policy and ensure it is communicated, available, and appropriate. It does not identify this as “planning the OH and S policy.” In ISO 45001 wording, policy is something to be established, maintained, and communicated, not described as a planning activity.

Therefore, the option that is not identified as a planning activity in ISO 45001 Clauses 4–10 is:

C

Hazard: A potential source of harm or adverse health effects.

Risk: The likelihood of harm occurring as a result of the hazard.

Danger: An immediate threat that requires urgent action.

Analysis of Options:

A. Conference room emergency sign directs people to an exit that is no longer available for use (Hazard):Correctly identified as a hazard since it poses a potential risk during emergencies.

B. The carpet on the main staircase is peeling off (Risk):This is a hazard, not a risk, as it represents a source of potential harm.

C. The emergency light in the gift shop did not work when checked (Risk):This is a hazard because it is a condition that could lead to a risk during emergencies.

D. The fire extinguishers in the Natural World area have not been serviced in the last five years (Risk):Correctly identified as a risk because the likelihood of fire-related harm increases without proper servicing.

E. The head of the dinosaur suspended over the main hall has become detached from the rest of the skeleton (Risk):This is a hazard, not a risk, as it represents a potential source of harm.

F. The non-slip mats have been removed from the restaurant (Risk):This is a hazard, not a risk.

G. There is a high possibility of unfit food being sold due to the failure of the oven temperature indicator in the visitors ' restaurant (Hazard):This is a risk because it specifies the likelihood of harm occurring (selling unfit food).

H. There is a water leak next to the electric heater in the admissions area (Danger):Correctly identified as a danger because it represents an immediate and critical threat.

ISO References:

Clause 6.1.2: Hazard identification and assessment of risks and opportunities.

Analysis of Options:

A. Results of management review:Correct. Clause 9.3 requires retention of management review results as documented information.

B. Risks and opportunities:Incorrect. Risks and opportunities must be considered and managed, but retaining this as documented information is not mandatory.

C. Results of compliance evaluation:Correct. Clause 9.1.2 requires retention of compliance evaluation results.

D. Workers ' current level of competency:Incorrect. Competency must be ensured, but retaining specific competency records is not explicitly required.

E. Assigned responsibilities and authorities:Incorrect. These must be defined and communicated but are not required to be retained as documented information.

F. The relevant requirements of workers:Incorrect. Relevant worker requirements must be considered but not retained as documented information.

G. Effectiveness of corrective actions:Correct. Clause 10.2 requires retention of evidence of corrective actions taken.

H. OH and S Policy:Correct. Clause 5.2 requires the OH and S policy to be maintained as documented information.

ISO References:

Clause 5.2: OH and S policy.

Clause 9.1.2: Compliance evaluation.

Clause 9.3: Management review.

Clause 10.2: Corrective actions.