OHSAS 18001 - (Section 4.5. - Checking and Corrective Action)

4.5.4. Audit

Section 4.5.4.1 Audit - Written Procedure

Is there a written procedure dealing with audits of the organisation?


Guidance: OHSAS 18001 requires that organisations carry out periodic OH&S management system audits and, as with all elements of the OH&S management system, organisations should have a written procedure for audit. This written procedure must meet certain criteria and these are dealt with in the questions in this section.

Verification guidance: This question is a document check. Give a "Yes" answer if there is a document which purports to be the organisation's OH&S audit procedure. The adequacy of this document is tested by the remainder of the questions in this section.


Question 4.5.4.1.1

Is the scope of the audit(s) dealt with adequately in the written procedure on audits?


Guidance: Audits should be used to check all aspects of an organisation's OH&S management system, and all of the organisation's activities. Organisations will have to consider how they will meet these requirements and record the results of their decisions.

Verification guidance: Answer "No" to this question if there is no clear statement of the scope of the organisation's OH&S audits, OR the stated scope does not cover all of the OH&S management system, OR the stated scope does not cover all relevant activities, locations etc.


Question 4.5.4.1.2

Is the frequency of the audit(s) dealt with adequately in the written procedure on audits?


Guidance: Although there is no specified frequency for audits in OHSAS 18001, OHSAS 18002 recommends an annual plan of audits which will cover all elements of the OH&S management system and the whole organisation covered by the OH&S management system. All aspects of compliance with OHSAS 18001 have to be audited and organisations should decide on the frequency with which this will be done on the basis of risk assessment results and the results of previous audits. However, note the following.

- Some elements of the OH&S management system and some of the organisation's activities may be more critical than others and organisations may decide to audit these more frequently.

- Audit frequencies may change on the basis of OH&S performance with, for example, audit frequencies being increased following poor audit results or accidents.

Verification guidance: Answer "No" to this question if there is no statement on audit frequencies, OR the frequency specified for audits of the whole OH&&S management system is inappropriate, OR no account is taken of the possible need for more frequent audits, OR the statement on frequency is inadequate in any other way.


Section 4.5.4.2 Audit Programme

Is there a written programme of audits?


Guidance: OHSAS 18001 requires organisation to establish and maintain an audit programme. This should describe what audits will be carried out, and where and when they will be carried out. Where an organisation will be using both internal and external audits, both types should be covered in the audit programme. This question checks that an organisation has a written audit programme, the adequacy of the programme is tested by the other questions in this section.

Verification guidance: This question is a document check. Give a "Yes" answer if there is a document which

purports to be the organisation's OH&S audit programme. The adequacy of this document is

tested by the remainder of the questions in this section.


Question 4.5.4.2.1

Is the audit programme based on the results of risk assessments of the organisation's activities?


Guidance: Factors which may be identified during a risk assessment which can influence the appropriate frequency for audits include the absolute level of risk, the reliability of the risk control measures in use, and the rate of change in activities. While organisations with a limited range of activities may find it appropriate to audit all of these activities at the same frequency, this is unlikely to be the case in organisations with a wide range of activities of varying levels of risk.

Verification guidance: Answer "No" to this question if there is no written programme of audits, OR there is no clear evidence that the results of risk assessments have been taken into account in drawing up the audit programme, OR the account taken of risk assessments is inadequate in any other way.


Section 4.5.4.3 Last Audit

Has the organisation's headquarters' function been audited?


Guidance: This section contains questions which test whether the last audit of the organisation's headquarters' function met the OHSAS 18001 requirements for OH&S audits. The adequacy of audits at other locations and of other functions should be tested using the 18001 SMi Evaluation. If the organisation's headquarters' function has not been audited for a valid reason, for example, implementation of OHSAS 18001 is in its early stages, then answer "Yes" to this question and "NA" to the rest of the questions in this section.

Answer "No" to this question if organisation's headquarters' function has not been audited, OR the audit did not take place within the time period specified for this audit. If the answer is "No" to this question then give "No" answers to the rest of the questions in this section.


Question 4.5.4.3.1

Planned arrangements. Did the last audit include an adequate determination of whether the OH&S management system conformed with planned arrangements?


Guidance: Organisationshave to assure themselves that what they have planned is in fact being carried out, and effective audit is one way of obtaining this assurance. Planned arrangements of relevance to OH&S include safe work procedures, the provision of personal protective equipment, machinery guarding, and so on.

Verification guidance: Answer "No" to this question if the written report of the last audit did not refer to conformance with planned arrangements, OR the sample of planned arrangements audited was not representative, OR the recommendations on planned arrangements were inadequate, OR planned arrangements were dealt with inadequately in any other way.


Question 4.5.4.3.2

OHSAS 18001 requirements. Did the last audit include an adequate determination of whether the OH&S management system conformed with OHSAS 18001 requirements?


Guidance: While OHSAS 18001 allows for a wide range of variation in OH&S management systems, they must all comply with certain key requirements. This question tests whether the last audit included an adequate check that the organisation's OH&S management system complied with OHSAS 18001 requirements. Whether the OH&S management system implementation and maintenance were audited is tested elsewhere in this evaluation.

Verification guidance: Answer "No" to this question if the written report of the last audit did not refer to conformance with OHSAS 18001 requirements, OR the sample of OHSAS 18001 requirements audited was not representative, OR the recommendations on OHSAS 18001 requirements were inadequate, OR OHSAS 18001 requirements were dealt with inadequately in any other way.