PECB ISO-45001-Lead-Auditor PECB Certified OHSMS ISO 45001 Lead Auditor Exam Exam Practice Test

Clause 9.3 of ISO 45001:2018 defines inputs for management review, which must include information on performance trends, feedback, risks, and opportunities for improvement.

Analysis of Options:

A. Allocation of a bigger budget for the OHS department: This is an output of management review, not an input.

B. Decisions on improvements in the OHSMS: This is an output, not an input.

C. Decisions related to continual improvement opportunities: This is an output, not an input.

D. Procurement of new safety harnesses for workers: This is an operational action, not an input for management review.

E. Proposal to prioritize health and safety issues as a business strategy: Proposals may be discussed during review, but they are outputs.

F. Report showing the trend of an increase in safety incidents: Correct. This is a valid input that informs system performance.

G. Updates to the risk register: Correct. Risk updates are required inputs under Clause 6.1.2.

H. Worker feedback of positive and negative comments: Correct. Feedback is an essential input per Clause 5.4 and Clause 9.3.

ISO References:

Clause 9.3: Management review inputs.

Clause 5.4: Worker consultation and participation.

Explanation

Documented information on the organization’s legal requirements → Clause 6.1.3: Clause 6.1.3 requires the organization to identify, document, and maintain compliance obligations, including legal and other requirements relevant to OH and S.

Assessment of OH and S risks → Clause 6.1.2.2: Clause 6.1.2.2 mandates the organization to assess OH and S risks associated with its operations, taking into account hazards, controls, and work activities.

Internal and external issue determination → Clause 4.1: Clause 4.1 requires organizations to determine internal and external issues that affect the OH and S management system and its intended outcomes.

Agreements with the organization’s external providers → Clause 8.1.4.2: Clause 8.1.4.2 pertains to controlling external providers and ensuring their processes align with OH and S requirements, including documented agreements.

References

Clause 4.1: Understanding the organization and its context.

Clause 6.1.2.2: Assessment of risks and opportunities related to OH and S.

Clause 6.1.3: Compliance obligations.

Clause 8.1.4.2: Control of external providers.

2. Prepare the audit checklist, 3. Obtain objective evidence, 4. Review audit evidence, 5. Document findings

For a first-party audit, the sequence follows the normal audit flow described in ISO auditing guidance: first the audit is initiated and leadership is assigned, then audit activities are prepared, then evidence is collected during the audit, then that evidence is evaluated, then findings are recorded, and finally the audit report is issued. ISO 19011 describes the audit flow as initiating the audit, preparing audit activities, conducting audit activities, and preparing and distributing the audit report. ( ISO )

That is why, after 1. Appoint an audit team leader , the next correct step is 2. Prepare the audit checklist . The checklist is part of preparing for the audit and helps the auditor plan questions, clauses, process interactions, and sampling points before going on to collect evidence. ( WEDEAQ | Official VDA QMC Partner )

After preparation, the auditor moves to 3. Obtain objective evidence . Audit evidence is gathered through interviews, observation, and review of documented information during the audit. This is a core activity of conducting the audit. ( DNV )

Once evidence is collected, the auditor must 4. Review audit evidence . ISO audit practice requires the evidence to be evaluated against the audit criteria to determine whether conformity or nonconformity exists. Evidence is not simply collected and reported immediately; it is first reviewed and assessed. ( PRETESH BISWAS )

After reviewing the evidence, the auditor can 5. Document findings . Findings are the result of evaluating the evidence against criteria, so they logically come after evidence review. Recorded findings can include conformity, nonconformity, and opportunities for improvement, depending on the audit plan and method. ( PRETESH BISWAS )

The final step is 6. Issue the report , because the report is prepared only after the audit evidence has been reviewed and the findings have been determined and documented. ( ISO )

So, the correct full order is:

1. Appoint an audit team leader

2. Prepare the audit checklist

3. Obtain objective evidence

4. Review audit evidence

5. Document findings

6. Issue the report

ISO 45001 Clause 5.2 OH and S policy requires top management to establish, implement and maintain an OH and S policy that includes a commitment to provide safe and healthy working conditions, fulfill legal and other requirements, and achieve continual improvement of the OH and S management system. It also requires the policy to be communicated within the organization and to be available to interested parties, as appropriate .

B. The management is committed to health and safety improvement is correct because the policy states: “Continual health and safety improvement is a permanent objective of the organisation.” That clearly demonstrates commitment to improvement, which aligns with Clause 5.2.

C. The organisation intends to communicate its policy to external parties is correct because the policy says: “Where required, the policy shall be communicated to all interested parties.” This matches the ISO 45001 requirement that the OH and S policy be available to interested parties, as appropriate.

G. The organisation is committed to continual health and safety improvement is also correct because the statement explicitly says: “Continual health and safety improvement is a permanent objective of the organisation.” This directly reflects the requirement for continual improvement in the OH and S policy.

Why the other options are not supported by the policy statement:

A is not correct because the policy expresses intent to work in accordance with regulations, but it does not prove the organization meets all statutory requirements in practice.

D is not correct because the policy does not provide evidence of reputation.

E is not correct because the policy does not prove that processes actually deliver improvement; it only states commitment.

F is not correct because the policy mentions contractors, but it does not prove that contractors themselves are committed to health and safety.

H is not correct because the policy mentions safe experiences and customers, but it does not prove that customer health and safety requirements are satisfied.

Therefore, the three options for which the organization is meeting ISO 45001 policy requirements are:

B, C, G

Analysis of Options:

A. Results of management review: Correct. Clause 9.3 requires retention of management review results as documented information.

B. Risks and opportunities: Incorrect. Risks and opportunities must be considered and managed, but retaining this as documented information is not mandatory.

C. Results of compliance evaluation: Correct. Clause 9.1.2 requires retention of compliance evaluation results.

D. Workers ' current level of competency: Incorrect. Competency must be ensured, but retaining specific competency records is not explicitly required.

E. Assigned responsibilities and authorities: Incorrect. These must be defined and communicated but are not required to be retained as documented information.

F. The relevant requirements of workers: Incorrect. Relevant worker requirements must be considered but not retained as documented information.

G. Effectiveness of corrective actions: Correct. Clause 10.2 requires retention of evidence of corrective actions taken.

H. OH and S Policy: Correct. Clause 5.2 requires the OH and S policy to be maintained as documented information.

ISO References:

Clause 5.2: OH and S policy.

Clause 9.1.2: Compliance evaluation.

Clause 9.3: Management review.

Clause 10.2: Corrective actions.

Major nonconformities are raised when there is a systemic failure to meet ISO 45001 requirements that could lead to significant risks.

Analysis of Options:

B. Lack of a documented process for controlling outsourced work (8.1.4.3): Major nonconformity. A failure to control outsourced work is a serious systemic issue.

C. Failure to include OH and S policy in contractor contracts (5.2.f): Not a major nonconformity. While this is a nonconformity, it is procedural and not critical.

D. No hazard assessment for installation works (6.1.2.2): Major nonconformity. A lack of hazard assessment for site-specific tasks is a serious issue.

E. Missing safety data sheets for contractor chemicals (8.1.4.2): Not a major nonconformity. While important, this issue does not indicate systemic failure.

G. Chemical hazards on installation sites not referenced in the hazard list (6.1.2.2): Major nonconformity. This reflects a failure in hazard identification and risk assessment.

H. Internal audit program does not cover installation sites (9.2.2): Not a major nonconformity. This is a gap in auditing scope but does not directly endanger safety.

I. Safe use of chemicals left to contractors: Not a major nonconformity. This could be addressed through improved contractor oversight rather than indicating systemic failure.

ISO References:

Clause 8.1.4.3: Control of outsourced processes.

Clause 6.1.2.2: Hazard identification and risk assessment.

Clause 7.4.1: Communication requirements.

The correct answers are B and D .

In certification audits, the certification body decides the audit team composition and audit time using its own documented procedures and competence requirements. ISO/IEC 17021-1 requires the certification body to determine the competencies needed for the audit team and to assign an audit team that is competent for the audit scope. It also requires the certification body to determine the audit time needed to plan and accomplish a complete and effective audit.

IAF MD 5 further explains that the certification body should consider the composition and size of the audit team to ensure audit effectiveness. This means a client request for “only one auditor” may be considered , but it cannot simply be accepted just to reduce travel costs if that would undermine competence, coverage, or effectiveness.

Therefore:

B is correct because the OHS Manager should be told that audit duration and team make-up are decided in line with the certification body’s internal procedures .

D is correct because the request can be considered , and the certification body can respond after applying its rules and competence requirements.

Why the other options are incorrect:

A is not the best answer because the people managing the audit programme already operate within the certification body’s process.

C is inappropriate; a client request does not justify telling them to use another certification body.

E is incorrect because the accreditation body does not decide the audit team for the client’s audit.

F is incorrect because the request cannot be automatically accepted based only on cost saving.

Worker participation is a fundamental principle of ISO 45001 (Clause 5.4). It ensures workers at all levels are involved in key activities to enhance the OH and S management system ' s effectiveness.

Analysis of Options:

A. Determining competence requirements: Incorrect. Determining competence is primarily the responsibility of management, though workers may provide input.

B. Establishing OHS objectives: Correct. Worker involvement ensures objectives are realistic and relevant to workplace conditions (Clause 6.2).

C. Managing internal audit programme: Incorrect. Managing audits is typically a managerial responsibility, though workers may participate in audits.

D. Determining actions to eliminate hazards: Correct. Workers’ insights are critical in identifying and implementing actions to eliminate hazards (Clause 8.1.2).

E. Determining what needs to be communicated: Incorrect. While communication strategies impact workers, their participation in determining communication needs is not explicitly required.

F. Establishing OHS policy: Correct. Workers should be involved in developing policies to ensure relevance and buy-in (Clause 5.2).

ISO References:

Clause 5.4: Worker participation.

Clause 6.2: OHS objectives.

Clause 8.1.2: Hierarchy of controls and hazard elimination.

Clause 5.1 of ISO 45001:2018 requires top management to demonstrate leadership and commitment to the OH and S management system. This includes awareness of the OH and S policy and its objectives.

Analysis of Options:

A. As a member of the management team, the Deputy College Principal is not aware of the OHSMS policy: Correct. A lack of awareness of the policy reflects poor leadership commitment, which violates Clause 5.1.

B. OH and S improvement is not possible due to the lack of awareness of the OHSMS: Incorrect. While improvement may be hindered, this is not the main issue in this scenario.

C. The Deputy College Principal is not competent to manage the OHSMS: Incorrect. The Deputy’s competence to manage the OHSMS is not in question; the issue is their lack of awareness of key elements.

D. The OH and S policy only exists as a document in the College Principal’s office: Incorrect. The policy may be accessible but not effectively communicated or understood by management.

ISO References:

Clause 5.1: Leadership and commitment.

Clause 5.2: OH and S policy.

ISO 45001 Clause 4.2 requires the organization to determine the relevant interested parties , their relevant needs and expectations (requirements) , and which of those become legal or other requirements for the OH and S management system. Workers are explicitly central to ISO 45001, and the standard is aimed at providing safe and healthy workplaces and preventing work-related injury and ill health. Therefore, A. Workers requiring a safe environment in which to work is clearly a relevant requirement of a relevant interested party.

ISO 45001 Annex A.4.2 lists suppliers, contractors and subcontractors among examples of interested parties. Since externally provided products and services can affect OH and S performance, a requirement linked to minimizing the risk of harm in those products and services is relevant to the OH and S management system. That is why B. Subcontractor producing products and services that minimise the risk of harm is also relevant. It aligns with the standard’s treatment of contractors/subcontractors as interested parties and with operational control over externally provided products and services that can affect OH and S.

Why the others are not correct:

C. Competitors requiring information on the organisation ' s work environment is not a relevant OH and S requirement.

D. Top management requiring an annual bonus is a financial/personal issue, not an OH and S interested-party requirement.

E. Investors requiring maximum growth in return for their capital is a business expectation, but not a relevant OH and S requirement in this context.

F. Shareholders requiring guaranteed dividend payments is also financial and not relevant to the OH and S management system, even though shareholders may be interested parties in a broader business sense. ISO 45001 requires only the needs and expectations that are relevant to the OH and SMS to be determined.

The correct responses are C and D .

Certification bodies are required to have documented procedures for determining audit time and to determine the time needed to plan and accomplish a complete and effective audit . Audit duration is not something that can simply be shortened because the client asks for less disruption. ISO/IEC 17021-1 requires the certification body to determine audit time through its documented process, and the justification for the duration must be recorded. ( IAS )

IAF MD 5 also states that certification bodies shall identify the audit time for each client and that this framework is used within the certification body’s processes to determine the appropriate audit time , taking into account the specifics of the client organization. That means the request may be considered , but it does not have to be accepted. ( IAF )

Therefore:

C. Advise that his request will be considered but may not be taken up is correct, because the certification body can review the request, but the final decision must still comply with its audit-time rules and adequacy requirements. ( IAF )

D. Advise the OHS Manager that the audit duration and team make-up will be decided in line with the internal procedures of the certification body is correct, because ISO/IEC 17021-1 requires the certification body to use documented procedures for audit time and team decisions. ( IAS )

Why the other options are incorrect:

A is inappropriate because the request is not automatically a reason to tell the client to choose another certification body.

B is incorrect because the request cannot simply be accepted without following the certification body’s rules. ( IAS )

E is too absolute; the request should be considered against the certification body’s requirements, not rejected automatically. ( IAF )

F is unnecessary because the people managing the audit programme already have the responsibility to handle such matters through the certification body’s procedures. ( IAS )

The correct answers are D and F .

In audit interviewing practice, open questions are mainly used to get explanation, description, and insight, while closed questions are used to confirm specific facts or verify that the auditor’s understanding is correct. Guidance on audit interviews says auditors should rely mainly on open questions for expanded responses and use closed questions to confirm answers . ( The Auditor )

That is why D. To confirm conformity or a non-conformity finding is correct. Once the auditor has gathered evidence, a closed question can be used to verify a precise point, confirm whether a requirement has or has not been met, or make sure the factual basis of a conformity/nonconformity is accurate before recording the finding. ISO 19011 also states that nonconformities and supporting audit evidence should be reviewed with the auditee so the evidence is accurate and understood. ( Synersia Foundation )

F. To check that your understanding of a situation is correct is also correct. Closed questions are especially useful at the end of a discussion to confirm the auditor’s interpretation of what was said or observed. This is a standard interview technique in auditing. ( Designing Buildings )

Why the other options are not correct:

A. To obtain an overview of how a task is performed is better done with open questions , because the auditor needs explanation and sequence. ( The Auditor )

B. To establish communication with the auditee with a view to building trust is usually done through general conversation and open dialogue, not mainly through closed questioning. ( The Auditor )

C. To gain greater insight into the operation of a process also requires open questions . ( The Auditor )

E. To follow your audit trail generally needs probing and exploratory questions, which are typically open rather than closed. ( The Auditor )

The closing meeting of a second-party audit focuses on the findings, conformance to agreed requirements, and areas for improvement. ISO 19011:2018 provides guidance on closing meetings, stating that the results of the audit, including conformity with criteria, must be reviewed and agreed upon.

Analysis of Options:

A. The names and email addresses of attendees at the closing meeting: Irrelevant. Attendance details are not part of the audit discussion.

B. The extent of the auditee’s documented information system: While relevant during the audit, it is not typically a focus in the closing meeting.

C. The extent to which the auditee is conforming to OH and S requirements in supply contracts: Correct. Second-party audits often assess compliance with contractual requirements.

D. The extent to which the auditee conforms to ISO 45001 requirements: Correct. The core purpose of the audit is to evaluate conformity to ISO 45001.

E. The nature of the trading relationship between the organizations: Correct. The trading relationship often shapes the scope and context of second-party audits.

F. Whether the audit has correctly performed in current contracts with other customers: Irrelevant. The focus is on the specific audit, not contracts with other customers.

G. Whether the work instructions for a specific OH and S process are focused on efficiency: Irrelevant. Efficiency is not the primary focus of an OH and S audit.

ISO References:

ISO 19011:2018, Clause 6.6.1: Conducting the closing meeting.

ISO 45001:2018, Clause 9.2: Internal audit requirements.

ISO 45001:2018 requires a holistic approach to occupational health and safety. This means considering all aspects that could impact worker well-being, not just obvious physical hazards. The correct answer encompasses work activities (the tasks themselves), workplace design (the physical environment), and human factors (psychological and social aspects like working hours and harassment). It ' s the most comprehensive and aligned with the standard ' s philosophy

ISO 45001:2018, Clause 6.1.2, outlines requirements for hazard identification . Hazards to consider include work activities, workplace design, human factors, and social factors that may impact OH and S. These go beyond traditional physical risks and include psychosocial and organizational hazards.

Analysis of Options:

A. Work activities, workplace design, and human factors such as hours of work and bullying and harassment: Correct. This comprehensively addresses hazard categories outlined in ISO 45001, Clause 6.1.2.

B. Work activities where there is the possibility of danger: Too general. ISO 45001 includes broader categories of hazards, including those related to organizational and social factors.

C. Hot-work, working at height, enclosed space entry, and work on electrical equipment: Too narrow. These are specific hazards but do not encompass the full range outlined in ISO 45001.

D. Work hazards and environmental factors such as bad weather: Incomplete. While environmental factors are relevant, ISO 45001 also includes workplace design, human factors, and psychosocial hazards.

ISO References:

Clause 6.1.2.1: Hazard identification.

Annex A.6.1.2: Examples of hazard categories, including workplace design and human factors.

Clause 10.2 of ISO 45001 requires organizations to investigate incidents, determine root causes, and implement corrective actions to prevent recurrence.

Analysis of Options:

A. Check whether corrective actions were taken. This directly relates to the requirement to implement corrective actions to address the identified risks and hazards. Failure to do so would indicate nonconformity.

B. Determine whether the Health and Safety Authority was notified. Notification is a legal requirement in certain jurisdictions, but it is not explicitly required under ISO 45001 unless the legal context demands it.

C. Establish whether the root cause was determined. Root cause analysis is fundamental for effective corrective action. Without this, corrective measures may not address the underlying problem.

D. Find out when the operator ' s machine was last subject to maintenance. While maintenance is important, it does not directly address the incident ' s nonconformity.

E. Find out whether the operator was sent to the hospital. Sending the operator to the hospital is a reactive step and not relevant to compliance with Clause 10.2.

F. Interview the operator about PPE usage. This is relevant but insufficient for determining compliance with Clause 10.2.

ISO References:

Clause 10.2: Investigation of incidents, determination of causes, and implementation of corrective actions.

Clause 8.1.2: Hierarchy of controls and risk reduction.

ISO 45001 defines " documented information " as information required to be controlled and maintained by an organization. This can include policies, procedures, records, or other relevant data in any format (Clause 3.19). It encompasses all information used to establish, operate, and demonstrate the effectiveness of the OH and S management system.

Analysis of Options:

A. Any paperwork generated when the system is in operation: Incorrect. This is too narrow and excludes digital or other formats.

B. Any information about the system, or generated by it, held in any format: Correct. This aligns with the ISO 45001 definition in Clause 3.19.

C. Paperwork such as Permits to Work and risk assessments: Incorrect. These are examples of documented information but do not encompass the full scope of the term.

D. The master copies of the documents used to operate the system, held in any format: Incorrect. This definition is limited to master copies, while documented information includes records as well.

ISO References:

Clause 3.19: Definition of documented information.

Clause 7.5: Control of documented information.

Clause 9.1.2 of ISO 45001:2018 outlines the need for organizations to evaluate compliance with applicable legal and other requirements as part of their OH and S management system.

Analysis of Options:

A. The organization must evaluate its compliance status at least once a year: The standard does not prescribe a specific frequency but states that evaluations must be conducted at planned intervals.

B. ' Other requirements ' include requirements that the organization has chosen to comply with: Correct. Other requirements may include voluntary standards, industry codes, or contractual obligations.

C. A management review is required in all instances where one or more legal requirements are not being met: This is not true. Management reviews address compliance but are not mandated for every noncompliance.

D. Every member of an audit team must have a detailed understanding of the legal requirements for the sector and type of organization they are auditing: Not true. Auditors must have general competency but can rely on subject-matter experts for legal specifics.

E. If the organization is failing to address a legal requirement relating to another discipline (e.g., Environmental management), this cannot be raised in the audit: Not true. If the legal noncompliance impacts OH and S, it can be raised.

F. The organization cannot outsource its process for evaluating compliance: The organization can outsource evaluation but retains accountability.

G. The organization is required to establish a process for evaluating compliance: Correct. Clause 9.1.2 requires a process for compliance evaluation.

H. The organization is required to evaluate its compliance status with OH and S legal and other requirements: Correct. Clause 9.1.2 explicitly states this requirement.

ISO References:

Clause 9.1.2: Evaluation of compliance.

Clause 7.5: Documented information requirements

The correct answers are D, F, H .

ISO 19011 guidance on generating audit findings says that nonconformities can be graded depending on the context of the organization and its risks . That directly supports D , because any grading should reflect the risk the nonconformity presents to the organization. The same guidance also says this grading can be quantitative (for example 1 to 5) or qualitative (for example minor/major) , which makes F correct. Because the wording is “can be graded” , grading is optional rather than mandatory, so H is also true. ( Synersia Foundation )

Why the other options are not true:

A is not a requirement in ISO 19011. An organization may define grading rules in its audit programme or procedure, but there is no rule that grading must be agreed with the individual(s) managing the audit programme. ( ISO )

B is false. ISO 19011 does not recommend that top management grade nonconformities. Audit findings are generated by auditors based on objective evidence and audit criteria. ( ISO )

C is false. A second-party audit team does not have to adopt the auditee’s grading system. The grading approach can follow the auditing organization’s own rules and purpose for the audit. ( ISO )

E is false. Additional documented information at the closing meeting does not mean the grading must be changed. The evidence should be reviewed, but unresolved issues may simply remain recorded in the audit report. ( Synersia Foundation )

G is false. There is no requirement that extra grading categories must be agreed with the auditee before the closing meeting. The auditee should understand the findings, but the grading framework is not something ISO 19011 requires to be negotiated at that point. ( ISO )

Audit reports should focus on objective evidence, observations, and findings relevant to the management system and the audit process. Personal opinions, unrelated remarks, or derogatory comments are inappropriate.

Analysis of Statements:

A. The guide was trying to be helpful and would not stop talking during the audit: Incorrect. This is irrelevant to the audit findings or conclusions.

B. The Sales Manager was kind and seems to be a nice person: Incorrect. Personal opinions about individuals are not appropriate in audit reports.

C. The audit client’s objectives for this audit were never realistic. That’s why we were unable to complete the audit plan: Correct. This is relevant as it relates to the audit process and highlights challenges in meeting objectives.

D. The maintenance team could not replace a lightbulb, let alone an air conditioning unit: Incorrect. This is derogatory and irrelevant to the audit report.

E. The OHS Management team were extremely helpful and went out of their way to facilitate access to required records: Correct. This is a valid observation about cooperation during the audit process.

F. The OHS Manager disagreed with me in respect of all of the nonconformances I raised. He still does not accept any of them: Incorrect. While disagreements may occur, this statement is overly subjective and not constructive.

G. The Production Manager is lucky to have a job as he does not appear to understand how anything works around here: Incorrect. Personal attacks or irrelevant judgments have no place in the report.

H. The Sales Manager said he had forgotten the password to the Sales Ordering system and so too had everyone else in his department: Correct. This relates to system access and could indicate a nonconformance or an opportunity for improvement.

ISO References:

ISO 19011:2018, Clause 6.7: Reporting audit results.