Pass the PECB ISO 45001 ISO-45001-Lead-Auditor Questions and answers with Dumpstech

A nonconformity is raised against the organisation ' s management system and applicable audit criteria, not personally against an individual manager or top management as a separate auditee. ISO 45001 Clause 5.1 makes top management accountable for ensuring that resources needed for the OHSMS are available, while Clause 7.1 explicitly requires the organisation to determine and provide resources needed for establishing, implementing, maintaining and continually improving the OHSMS. If sufficient objective evidence demonstrates that these requirements have not been fulfilled, a nonconformity is appropriate. However, its wording should identify the organisational failure and the relevant requirement, supported by objective evidence. Option A incorrectly assumes resource adequacy cannot be audited, while D incorrectly treats top management personally as the object of the nonconformity. Additional evidence can be useful, but B does not address the fundamental issue.

The correct responses are C and D.

Certification bodies are required to have documented procedures for determining audit time and to determine the time needed to plan and accomplish a complete and effective audit. Audit duration is not something that can simply be shortened because the client asks for less disruption. ISO/IEC 17021-1 requires the certification body to determine audit time through its documented process, and the justification for the duration must be recorded. (IAS)

IAF MD 5 also states that certification bodies shall identify the audit time for each client and that this framework is used within the certification body’s processes to determine the appropriate audit time, taking into account the specifics of the client organization. That means the request may be considered, but it does not have to be accepted. (IAF)

Therefore:

C. Advise that his request will be considered but may not be taken up is correct, because the certification body can review the request, but the final decision must still comply with its audit-time rules and adequacy requirements. (IAF)

D. Advise the OHS Manager that the audit duration and team make-up will be decided in line with the internal procedures of the certification body is correct, because ISO/IEC 17021-1 requires the certification body to use documented procedures for audit time and team decisions. (IAS)

Why the other options are incorrect:

A is inappropriate because the request is not automatically a reason to tell the client to choose another certification body.

B is incorrect because the request cannot simply be accepted without following the certification body’s rules. (IAS)

E is too absolute; the request should be considered against the certification body’s requirements, not rejected automatically. (IAF)

F is unnecessary because the people managing the audit programme already have the responsibility to handle such matters through the certification body’s procedures. (IAS)

Analysis of Options:

A. Integrated Management System:Correct. An Integrated Management System (IMS) combines multiple standards like ISO 45001, ISO 14001, and ISO 9001, addressing environment management as part of the integration.

B. ISO 14501:Incorrect. ISO 14501 pertains to milk and milk products, not environmental management.

C. ISO 45001:Incorrect. ISO 45001 focuses on Occupational Health and Safety, not environmental management.

D. ISO 14001:Correct. ISO 14001 is the primary standard for Environmental Management Systems.

ISO References:

ISO 14001: Environment Management Systems.

Integrated Management Systems: Combines standards like ISO 14001 and ISO 45001.

The PDCA cycle (Plan-Do-Check-Act) is a core framework in ISO 45001 for continual improvement of the OH and S management system. An Environmental Management Program is part of ISO 14001 (Environmental Management System) and not ISO 45001.

Analysis of Options:

A. Treatment of Risks:Correct. Risk treatment is part of the Plan phase.

B. OHSMS Policy:Correct. The policy is developed in the Plan phase.

C. Environment Management Program:Incorrect. This is outside the scope of ISO 45001 and relates to ISO 14001.

D. Analyzing OHSMS Performance:Correct. Performance analysis is part of the Check phase.

ISO References:

Clause 0.3: PDCA framework in ISO 45001.

ISO 45001 defines " documented information " as information required to be controlled and maintained by an organization. This can include policies, procedures, records, or other relevant data in any format (Clause 3.19). It encompasses all information used to establish, operate, and demonstrate the effectiveness of the OH and S management system.

Analysis of Options:

A. Any paperwork generated when the system is in operation:Incorrect. This is too narrow and excludes digital or other formats.

B. Any information about the system, or generated by it, held in any format:Correct. This aligns with the ISO 45001 definition in Clause 3.19.

C. Paperwork such as Permits to Work and risk assessments:Incorrect. These are examples of documented information but do not encompass the full scope of the term.

D. The master copies of the documents used to operate the system, held in any format:Incorrect. This definition is limited to master copies, while documented information includes records as well.

ISO References:

Clause 3.19: Definition of documented information.

Clause 7.5: Control of documented information.

In a first-party audit (internal audit), the organization conducts the audit to determine whether its management system conforms to planned arrangements, to the organization’s own requirements, and to the requirements of ISO 45001, and whether it is effectively implemented and maintained. ISO 45001 Clause 9.2 requires internal audits to provide information on conformity and effectiveness.

E. Verify compliance with regulatory requirements is a valid audit objective because ISO 45001 requires the organization to determine its legal and other requirements and to evaluate compliance with them. Internal audits commonly include verification that these legal OH and S obligations are being met as part of checking the effectiveness and conformity of the OH and S management system. This aligns with Clause 6.1.3 and Clause 9.1.2 of ISO 45001.

B. Complete the audit on time is also an audit objective in practical first-party auditing because audit objectives are established for the audit and supported by planning, resources, timing, and reporting arrangements. While it is not a system conformance criterion, it is a valid objective for the audit assignment itself, ensuring the audit is performed as planned and efficiently managed. This fits normal lead auditor practice in planning and conducting internal audits.

Why the other options are not correct:

A. Apply international standards is too broad and is not itself an audit objective. Standards are the criteria or reference, not the objective.

C. Confirm the scope of the management system is accurate is not usually stated as a first-party audit objective; scope is established by the organization under Clause 4.3, though it may be reviewed during audits.

D. Prepare the audit report for the certification body does not apply to a first-party audit, because internal audits are not performed for a certification body.

F. Update the management policy is a management responsibility, not an audit objective. Audits may identify inputs for policy review, but updating the policy is not the purpose of the audit itself.

Therefore, the two correct options are:

B, E

ISO 45001 Clause 4.2 requires the organization to determine the relevant interested parties, their relevant needs and expectations (requirements), and which of those become legal or other requirements for the OH and S management system. Workers are explicitly central to ISO 45001, and the standard is aimed at providing safe and healthy workplaces and preventing work-related injury and ill health. Therefore, A. Workers requiring a safe environment in which to work is clearly a relevant requirement of a relevant interested party.

ISO 45001 Annex A.4.2 lists suppliers, contractors and subcontractors among examples of interested parties. Since externally provided products and services can affect OH and S performance, a requirement linked to minimizing the risk of harm in those products and services is relevant to the OH and S management system. That is why B. Subcontractor producing products and services that minimise the risk of harm is also relevant. It aligns with the standard’s treatment of contractors/subcontractors as interested parties and with operational control over externally provided products and services that can affect OH and S.

Why the others are not correct:

C. Competitors requiring information on the organisation ' s work environment is not a relevant OH and S requirement.

D. Top management requiring an annual bonus is a financial/personal issue, not an OH and S interested-party requirement.

E. Investors requiring maximum growth in return for their capital is a business expectation, but not a relevant OH and S requirement in this context.

F. Shareholders requiring guaranteed dividend payments is also financial and not relevant to the OH and S management system, even though shareholders may be interested parties in a broader business sense. ISO 45001 requires only the needs and expectations that are relevant to the OH and SMS to be determined.

ISO 45001 emphasizes worker participation and engagement at all levels of the organization to support continuous improvement (Clause 5.4 and Clause 10.3). Continuous improvement requires input from everyone, including workers who identify hazards, report incidents, and contribute to safety enhancements.

Analysis of Options:

A. Everyone, at all levels of the company:Correct. Clause 5.4 explicitly includes all levels of the organization in consultation and participation, fostering continuous improvement.

B. Top management and senior officers only:Incorrect. While top management plays a crucial role in leadership, ISO 45001 extends the responsibility for participation to all levels.

C. Top management, senior officers, and designated safety representatives only:Incorrect. Limiting participation to designated representatives excludes a significant portion of the workforce from the improvement process.

D. Top management only:Incorrect. While top management must lead and commit to continuous improvement, their involvement alone is insufficient under ISO 45001.

ISO References:

Clause 5.4: Worker consultation and participation.

Clause 10.3: Continual improvement.

The two options that give the strongest cause for concern are E and F.

E. The oil on the floor might spread to other areas of the kitchen is a clear OH and S concern because the spilled oil already presents a slip hazard in the work area and could increase the risk further if it spreads. ISO 45001 requires the organization to eliminate hazards and reduce OH and S risks through operational control. A spreading oil spill shows inadequate control of a workplace hazard and poor housekeeping in an active kitchen environment.

F. Fire protection may be inadequate without adjacent safety equipment is also a strong concern. In a kitchen with hot oil, boiling water, and multiple ignition sources, the absence of visible fire extinguishers or fire blankets raises concern about the adequacy of emergency preparedness and operational control. ISO 45001 requires organizations to establish processes for emergency preparedness and response, including provision for relevant emergency equipment where needed.

Why the other options are weaker:

A is speculative and refers to the storeroom, even though the immediate issue is the unsafe condition in the kitchen.

B is an assumption about workload, not objective evidence of a system failure.

C may be true, but impurities in waste oil are not the key OH and S issue identified here.

D focuses on whether cleaning arrangements are documented, but ISO 45001 does not require every control to be a documented procedure; the stronger evidence is the unsafe condition itself.

The correct answer is A. Audit findings that pose a significant health and safety risk.

In management system auditing practice, the audit team leader is expected to maintain communication with the auditee during the audit, especially when serious issues are identified. Where audit evidence indicates a significant risk, this should be communicated without waiting for the closing meeting, so the organization can take prompt action if needed. ISO guidance on conducting audits emphasizes communication during the audit and presentation of findings and conclusions at the closing meeting, while serious risks are handled immediately rather than being delayed. (ISO)

Why the other options are not correct:

B. The outcome of the audit, including the conclusion is normally communicated at the closing meeting, not before it. (Advisera)

C. Diverging opinions within the audit team are internal audit team matters. Only unresolved issues relevant to audit results may be raised appropriately, but internal team differences are not the key information to communicate beforehand.

D. Performance of individual workers when responding to health and safety-related questions is not the purpose of audit reporting. A management system audit evaluates the system and its implementation, not individual worker appraisal.

Therefore, the information that should be communicated to the auditee before the closing meeting is:

A. Audit findings that pose a significant health and safety risk.