ISO-45001-Lead-Auditor Exam Dumps - PECB Certified OHSMS ISO 45001 Lead Auditor Exam

ISO 45001 Clause 8.1.3 Management of change states that the organization must establish processes for the implementation and control of planned temporary and permanent changes that impact OH and S performance. It also says this includes new products, services and processes, and changes to existing products, services and processes. That makes A true. It also supports B, because the clause is specifically about changes that impact the organization’s OH and S performance.

Statement E is also true. If the organization decides, after an emergency preparedness and response exercise, that it needs to change part of the OHSMS to improve OH and S performance, then that change has to be implemented in a controlled way under the organization’s management-of-change process. ISO 45001 links emergency preparedness with improvement and requires changes impacting OH and S performance to be controlled.

Why the others are false:

C is false because ISO 45001 does not limit management of change to planned changes only. It says the organization must also review the consequences of unintended changes and take action to mitigate adverse effects.

D is false because Clause 8.1.3 does not require retaining documented information of all changes. The clause requires establishing processes for implementation and control, but it does not state a blanket requirement to retain documented information for every change.

F is false because developments in knowledge and technology are explicitly included in management of change, not excluded.

G is false because changes are not limited to those identified by the organization itself; the clause also includes changes in legal and other requirements, and changes in knowledge or information about hazards and risks.

H is false because ISO 45001 explicitly says management of change applies to temporary and permanent planned changes.

The correct answer is D.

ABC states that it has implemented one single OH and S management system for both plants. Once a single management system covers both sites, the certification body has to determine and audit the scope of the management system being operated, not an artificially narrowed commercial scope. IAF MD 1 says a multi-site organization has a single management system, and the certification body must confirm that a single management system is deployed and determine the scope of the management system being operated. It also says the certification document must reflect the scope of certification and the sites/legal entities covered by that multi-site certification. (IAF)

The argument that XYZ is “just a supplier” does not solve the problem. IAF MD 5 makes an important distinction: where an external provider is only a supplier, the certification body audits the organization’s control of the supplied activity, not the performance of the activity itself. But here, XYZ is not outside the management system; ABC has already said both plants are inside one single OHSMS. So XYZ cannot simply be treated as an external supplier for certification-scoping purposes. (IAF)

This is also consistent with the multi-site certification rules that do not allow an organization to exclude covered sites just to avoid certification consequences. IAF MD 1 explicitly says it is not admissible to exclude a problematic site from scope during certification, and the certification documents must show the sites covered by the certified system. While this example is about a “problematic” site, the principle is the same: once the site is part of the single management system, it cannot be carved out simply for convenience or marketing. (IAF)

Therefore, as a third-party auditor, you should not agree to audit only the food plant while ignoring the packaging plant if both are included in the same ISO 45001 management system.

Clause 6.1.2 of ISO 45001:2018 emphasizes the identification of hazards and assessment of risks, and Clause 5.4 highlights the importance of consultation and communication among roles. The auditor ' s role includes verifying conformity to these clauses through evidence gathering and observation.

Analysis of Options:

A. The auditor should advise the organization to get rid of the walled area.This is outside the scope of an auditor’s role, which is to observe and report findings, not to dictate specific actions.

B. The auditor should ask the Maintenance Manager to conduct a safety survey.While safety surveys are useful, asking the Maintenance Manager to conduct one is not the auditor’s responsibility.

C. The auditor should check the lines of communication between the OHS Manager and Maintenance Manager.This aligns with ISO 45001:2018, Clause 5.4, as communication gaps may have contributed to the situation.

D. The auditor should check whether the organization has identified the safety hazards associated with the walled area.Clause 6.1.2 requires hazard identification. The auditor must determine whether this has been done.

E. The auditor should consider surveying more areas of the site for other potentially unsafe situations.Broadening the audit scope to identify additional risks is a good practice in line with Clause 9.2.2.

F. The auditor should demand that the Maintenance Manager deals with the wall.Demanding action is not within the auditor’s authority. The auditor should raise findings instead.

G. The auditor should raise a nonconformity against ISO 45001.While this may be appropriate depending on evidence, raising a nonconformity is not a replacement for good audit practices.

H. The auditor should refer the organization to health and safety authorities.This step is extreme and should only occur if there is an imminent danger and no action is being taken.

ISO References:

Clause 6.1.2: Hazard identification and risk assessment.

Clause 5.4: Worker consultation and participation.

Clause 9.2.2: Internal audit program and execution.

ISO 45001 defines " documented information " as information required to be controlled and maintained by an organization. This can include policies, procedures, records, or other relevant data in any format (Clause 3.19). It encompasses all information used to establish, operate, and demonstrate the effectiveness of the OH and S management system.

Analysis of Options:

A. Any paperwork generated when the system is in operation:Incorrect. This is too narrow and excludes digital or other formats.

B. Any information about the system, or generated by it, held in any format:Correct. This aligns with the ISO 45001 definition in Clause 3.19.

C. Paperwork such as Permits to Work and risk assessments:Incorrect. These are examples of documented information but do not encompass the full scope of the term.

D. The master copies of the documents used to operate the system, held in any format:Incorrect. This definition is limited to master copies, while documented information includes records as well.

ISO References:

Clause 3.19: Definition of documented information.

Clause 7.5: Control of documented information.

Analysis of Options:

A. The organisation must attempt to identify and address every risk it faces:Incorrect. ISO 45001 focuses on OH and S risks and not every risk faced by the organization.

B. The effect of uncertainty (i.e. risk) can result in positive outcomes as well as negative ones:Correct. Clause 3.20 defines risk as the " effect of uncertainty, " which may result in positive or negative outcomes.

C. Although organisations are required to carry out risk management, the method by which they do so is up to them:Correct. ISO 45001 does not prescribe specific risk management methods, leaving the organization to choose the approach that best suits its context (Clause 6.1.2).

D. Risk assessment is an activity that must be carried out by top management:Incorrect. Risk assessment can involve workers and other personnel; it is not limited to top management.

E. The organisation is required to assess risks arising from OH and S hazards:Correct. Clause 6.1.2.2 requires organizations to assess OH and S risks associated with hazards.

F. Risk is often expressed as a combination of likelihood and impact:Correct. This is a common way to express risk, aligned with Clause 6.1.2.

ISO References:

Clause 3.20: Definition of risk.

Clause 6.1.2: Hazard identification and risk assessment

ISO 45001 Clause 5.2 OH and S policy requires top management to establish, implement and maintain an OH and S policy that includes a commitment to provide safe and healthy working conditions, fulfill legal and other requirements, and achieve continual improvement of the OH and S management system. It also requires the policy to be communicated within the organization and to be available to interested parties, as appropriate.

B. The management is committed to health and safety improvement is correct because the policy states: “Continual health and safety improvement is a permanent objective of the organisation.” That clearly demonstrates commitment to improvement, which aligns with Clause 5.2.

C. The organisation intends to communicate its policy to external parties is correct because the policy says: “Where required, the policy shall be communicated to all interested parties.” This matches the ISO 45001 requirement that the OH and S policy be available to interested parties, as appropriate.

G. The organisation is committed to continual health and safety improvement is also correct because the statement explicitly says: “Continual health and safety improvement is a permanent objective of the organisation.” This directly reflects the requirement for continual improvement in the OH and S policy.

Why the other options are not supported by the policy statement:

A is not correct because the policy expresses intent to work in accordance with regulations, but it does not prove the organization meets all statutory requirements in practice.

D is not correct because the policy does not provide evidence of reputation.

E is not correct because the policy does not prove that processes actually deliver improvement; it only states commitment.

F is not correct because the policy mentions contractors, but it does not prove that contractors themselves are committed to health and safety.

H is not correct because the policy mentions safe experiences and customers, but it does not prove that customer health and safety requirements are satisfied.

Therefore, the three options for which the organization is meeting ISO 45001 policy requirements are:

B, C, G

In a first-party audit (internal audit), the organization conducts the audit to determine whether its management system conforms to planned arrangements, to the organization’s own requirements, and to the requirements of ISO 45001, and whether it is effectively implemented and maintained. ISO 45001 Clause 9.2 requires internal audits to provide information on conformity and effectiveness.

E. Verify compliance with regulatory requirements is a valid audit objective because ISO 45001 requires the organization to determine its legal and other requirements and to evaluate compliance with them. Internal audits commonly include verification that these legal OH and S obligations are being met as part of checking the effectiveness and conformity of the OH and S management system. This aligns with Clause 6.1.3 and Clause 9.1.2 of ISO 45001.

B. Complete the audit on time is also an audit objective in practical first-party auditing because audit objectives are established for the audit and supported by planning, resources, timing, and reporting arrangements. While it is not a system conformance criterion, it is a valid objective for the audit assignment itself, ensuring the audit is performed as planned and efficiently managed. This fits normal lead auditor practice in planning and conducting internal audits.

Why the other options are not correct:

A. Apply international standards is too broad and is not itself an audit objective. Standards are the criteria or reference, not the objective.

C. Confirm the scope of the management system is accurate is not usually stated as a first-party audit objective; scope is established by the organization under Clause 4.3, though it may be reviewed during audits.

D. Prepare the audit report for the certification body does not apply to a first-party audit, because internal audits are not performed for a certification body.

F. Update the management policy is a management responsibility, not an audit objective. Audits may identify inputs for policy review, but updating the policy is not the purpose of the audit itself.

Therefore, the two correct options are:

B, E