PECB ISO-45001-Lead-Auditor Dumps

ISO 45001:2018 Clause 9.3.3 states that the outputs of management review shall include decisions related to:

the continued suitability, adequacy and effectiveness of the OH and S management system,

opportunities for continual improvement ,

any need for changes to the OH and S management system ,

resources needed ,

actions, if needed,

opportunities to improve integration of the OH and S management system with other business processes, and

any implications for the strategic direction of the organization.

Based on that, the six correct outputs are:

B. Procurement of new safety harnesses for workers

This is evidence of an action/resource decision arising from management review. It shows management has decided to provide resources or take action to improve OH and S performance.

D. Allocation of a bigger budget for the OHS department

This clearly matches resources needed , which is specifically listed as a management review output.

E. Plan to prioritise health and safety issues as a business strategy

This fits implications for the strategic direction of the organization , which ISO 45001 names as a management review output.

F. Decisions related to continual improvement opportunities

This is almost verbatim from Clause 9.3.3: management review outputs include decisions related to opportunities for continual improvement .

G. Improvements in the OHSMS

This reflects changes needed in the OH and S management system and resulting improvement actions. Where management review decisions lead to system improvements, those improvements are valid output evidence from the review.

J. Opportunities to integrate the OHS management system with other business processes

This is directly stated in Clause 9.3.3 as a required management review output.

Why the other four are not outputs:

A. Report showing the trend of an increase in safety incidents is an input to management review under performance information and trends, not an output.

C. Minutes of previous management reviews are also an input , because management review must consider the status of actions from previous reviews.

H. Worker feedback of positive and negative comments is an input , linked to consultation, participation, and relevant communications.

I. Updates to the risk register may result from actions elsewhere in the system, but they are not specifically identified in ISO 45001 as required management review outputs.

Therefore, the six statements that represent output audit evidence for management review are:

B, D, E, F, G, J

Clause 5.1 of ISO 45001:2018 requires top management to demonstrate leadership and commitment to the OH and S management system. This includes awareness of the OH and S policy and its objectives.

Analysis of Options:

A. As a member of the management team, the Deputy College Principal is not aware of the OHSMS policy: Correct. A lack of awareness of the policy reflects poor leadership commitment, which violates Clause 5.1.

B. OH and S improvement is not possible due to the lack of awareness of the OHSMS: Incorrect. While improvement may be hindered, this is not the main issue in this scenario.

C. The Deputy College Principal is not competent to manage the OHSMS: Incorrect. The Deputy’s competence to manage the OHSMS is not in question; the issue is their lack of awareness of key elements.

D. The OH and S policy only exists as a document in the College Principal’s office: Incorrect. The policy may be accessible but not effectively communicated or understood by management.

ISO References:

Clause 5.1: Leadership and commitment.

Clause 5.2: OH and S policy.

Clause 10.2 of ISO 45001 requires organizations to investigate incidents, determine root causes, and implement corrective actions to prevent recurrence.

Analysis of Options:

A. Check whether corrective actions were taken. This directly relates to the requirement to implement corrective actions to address the identified risks and hazards. Failure to do so would indicate nonconformity.

B. Determine whether the Health and Safety Authority was notified. Notification is a legal requirement in certain jurisdictions, but it is not explicitly required under ISO 45001 unless the legal context demands it.

C. Establish whether the root cause was determined. Root cause analysis is fundamental for effective corrective action. Without this, corrective measures may not address the underlying problem.

D. Find out when the operator ' s machine was last subject to maintenance. While maintenance is important, it does not directly address the incident ' s nonconformity.

E. Find out whether the operator was sent to the hospital. Sending the operator to the hospital is a reactive step and not relevant to compliance with Clause 10.2.

F. Interview the operator about PPE usage. This is relevant but insufficient for determining compliance with Clause 10.2.

ISO References:

Clause 10.2: Investigation of incidents, determination of causes, and implementation of corrective actions.

Clause 8.1.2: Hierarchy of controls and risk reduction.

Analysis of Each Option:

Activities following the closure of a third-party audit are generally related to improving the audit process and addressing any unresolved issues.

Analysis of Options:

A. Addressing any audit complaints: Correct. Post-audit, complaints or concerns from stakeholders are addressed to improve the audit process and maintain credibility.

B. Conducting a closing meeting: Incorrect. The closing meeting occurs before the audit is closed.

C. Conducting a review of opportunities for improvement: Correct. Reviewing opportunities for improvement post-audit helps in refining processes and aligning them with organizational goals.

D. Revising the audit ' s objectives: Incorrect. Audit objectives are established during the planning phase, not after the audit has been closed.

E. Updating risks and opportunities to the audit programme: Incorrect. Updates to risks and opportunities occur during ongoing audits, not specifically post-audit.

F. Writing the audit report: Incorrect. The audit report is prepared before the audit is officially closed.

ISO References:

Clause 9.2.2: Audit process review.

ISO 19011:2018, Clause 6.7: Managing complaints and follow-up.

Audit objectives for the audit team focus on ensuring the audit process is executed effectively, efficiently, and without causing undue disruption to the organization being audited. ISO 19011:2018 provides guidance on setting audit objectives.

Analysis of Options:

A. To reduce instances of injury and ill health: Incorrect. This is an objective of the OH and S management system, not of the audit itself.

B. To minimise risk resulting from the audit process: Correct. ISO 19011 emphasizes managing risks to the auditee and the audit process during audits (Clause 5.4).

C. To improve overall health and safety performance: Incorrect. Improving health and safety performance is an outcome of the OH and S management system, not the audit team ' s objective.

D. To complete the audit on time: Correct. Ensuring timely completion of the audit aligns with effective audit management.

E. To implement any necessary corrective action: Incorrect. Implementing corrective actions is the auditee’s responsibility, not the audit team’s.

Analysis of Options:

A. Results of management review: Correct. Clause 9.3 requires retention of management review results as documented information.

B. Risks and opportunities: Incorrect. Risks and opportunities must be considered and managed, but retaining this as documented information is not mandatory.

C. Results of compliance evaluation: Correct. Clause 9.1.2 requires retention of compliance evaluation results.

D. Workers ' current level of competency: Incorrect. Competency must be ensured, but retaining specific competency records is not explicitly required.

E. Assigned responsibilities and authorities: Incorrect. These must be defined and communicated but are not required to be retained as documented information.

F. The relevant requirements of workers: Incorrect. Relevant worker requirements must be considered but not retained as documented information.

G. Effectiveness of corrective actions: Correct. Clause 10.2 requires retention of evidence of corrective actions taken.

H. OH and S Policy: Correct. Clause 5.2 requires the OH and S policy to be maintained as documented information.

ISO References:

Clause 5.2: OH and S policy.

Clause 9.1.2: Compliance evaluation.

Clause 9.3: Management review.

Clause 10.2: Corrective actions.

The best responses are D, E, and G .

D. Insist that the nonconformities must stand since there is clear evidence for them apart from the videos is correct because audit findings and nonconformities must be based on objective evidence . If the evidence supporting the findings exists independently of the videos, then the findings should not be rescinded simply because there is a dispute about how supplementary material was recorded. A problem with auditor conduct or site permission does not automatically invalidate valid audit evidence already obtained.

E. Advise the OHS Manager that they should speak to the supervisor to confirm the situation is also appropriate because the auditor stated that permission had been obtained from a supervisor who was part of the safety team. Before taking action, the audit team leader should verify the facts. This is a reasonable and proportionate response to clarify whether site permission was actually granted.

G. Indicate that he, as audit team leader, will seek approval for the taking of videos by auditors at the opening meetings with management at all audits in the future is appropriate because it addresses the control weakness going forward. Audit teams should be clear about site rules, confidentiality, and permissions for photographs or videos before audit activities begin. This is a constructive preventive action for future audits.

Why the other options are not the best:

A may be premature until the facts are verified.

B assumes misconduct before confirming the facts.

C is incorrect because auditors do not inherently “must” take videos.

F is too severe before the situation is properly established and investigated.

H is inappropriate because the audit team leader should not personally handle or manipulate the auditor’s personal phone.

The correct answer is A. Audit findings that pose a significant health and safety risk.

In management system auditing practice, the audit team leader is expected to maintain communication with the auditee during the audit, especially when serious issues are identified. Where audit evidence indicates a significant risk , this should be communicated without waiting for the closing meeting , so the organization can take prompt action if needed. ISO guidance on conducting audits emphasizes communication during the audit and presentation of findings and conclusions at the closing meeting, while serious risks are handled immediately rather than being delayed. ( ISO )

Why the other options are not correct:

B. The outcome of the audit, including the conclusion is normally communicated at the closing meeting , not before it. ( Advisera )

C. Diverging opinions within the audit team are internal audit team matters. Only unresolved issues relevant to audit results may be raised appropriately, but internal team differences are not the key information to communicate beforehand.

D. Performance of individual workers when responding to health and safety-related questions is not the purpose of audit reporting. A management system audit evaluates the system and its implementation, not individual worker appraisal.

Therefore, the information that should be communicated to the auditee before the closing meeting is:

A. Audit findings that pose a significant health and safety risk.

The auditor should assess whether the organization ' s planned action (using masks in case of dust extraction failure) is both implemented and effective. This aligns with ISO 45001 requirements to ensure that control measures are functional and meet the intended objectives.

Clause 8.1.2 (Hierarchy of Controls): The use of PPE, such as masks, is considered a last resort in the hierarchy of controls. The organization must demonstrate that the measure is:

Implemented (e.g., PPE is available and workers are trained to use it).

Effective (e.g., masks provide adequate protection against dust).

Analysis of Options:

A. Advise that the factory should cease operations if the dust extraction equipment malfunctioned. While ceasing operations may be a necessary control in extreme situations, it is not a practical or realistic recommendation unless a high-risk scenario cannot be otherwise managed.

B. Ask the OHSMS Manager to confirm regulatory compliance. Regulatory compliance is important but does not fully address the requirement to ensure the action is effective.

C. Seek evidence that the response action is both implemented and effective. This is the most appropriate response. The auditor must verify implementation and effectiveness to determine conformity.

D. Suggest increasing maintenance checks. Maintenance is important for preventing equipment breakdowns, but this option does not address the immediate audit finding about the adequacy of response actions.

ISO References:

Clause 8.1.2: Emphasizes applying the hierarchy of controls effectively.

Clause 9.1.1: Requires monitoring and measuring controls to ensure effectiveness.

According to ISO 45001:2018, the PDCA cycle is explained in Clause 0.4. The Act phase is defined as: taking actions to improve continually the OH and S performance in order to achieve the intended outcomes . This clearly supports C. Making improvements as a correct answer.

Option D. Resetting objectives is also appropriate because ISO 45001 requires OH and S objectives to be reviewed and updated as appropriate . After checking performance results, the organization may revise or reset objectives as part of continual improvement and corrective action. This aligns with the Act stage, where changes are made to improve system effectiveness and performance.

The remaining options belong to other PDCA phases:

A. Verifying training relates more to evaluation of competence and effectiveness, which fits checking activities.

B. Measuring objectives belongs to the Check phase because ISO 45001 says Check includes monitoring and measurement against OH and S policy and objectives.

E. Providing infrastructure belongs to the Do phase because it is part of providing resources and operational support.

F. Auditing processes belongs to the Check phase because internal audits are part of performance evaluation under Clause 9.2.

Therefore, the correct answer is:

C, D

Major nonconformities are raised when there is a systemic failure to meet ISO 45001 requirements that could lead to significant risks.

Analysis of Options:

B. Lack of a documented process for controlling outsourced work (8.1.4.3): Major nonconformity. A failure to control outsourced work is a serious systemic issue.

C. Failure to include OH and S policy in contractor contracts (5.2.f): Not a major nonconformity. While this is a nonconformity, it is procedural and not critical.

D. No hazard assessment for installation works (6.1.2.2): Major nonconformity. A lack of hazard assessment for site-specific tasks is a serious issue.

E. Missing safety data sheets for contractor chemicals (8.1.4.2): Not a major nonconformity. While important, this issue does not indicate systemic failure.

G. Chemical hazards on installation sites not referenced in the hazard list (6.1.2.2): Major nonconformity. This reflects a failure in hazard identification and risk assessment.

H. Internal audit program does not cover installation sites (9.2.2): Not a major nonconformity. This is a gap in auditing scope but does not directly endanger safety.

I. Safe use of chemicals left to contractors: Not a major nonconformity. This could be addressed through improved contractor oversight rather than indicating systemic failure.

ISO References:

Clause 8.1.4.3: Control of outsourced processes.

Clause 6.1.2.2: Hazard identification and risk assessment.

Clause 7.4.1: Communication requirements.

The correct answers are B and D .

In certification audits, the certification body decides the audit team composition and audit time using its own documented procedures and competence requirements. ISO/IEC 17021-1 requires the certification body to determine the competencies needed for the audit team and to assign an audit team that is competent for the audit scope. It also requires the certification body to determine the audit time needed to plan and accomplish a complete and effective audit.

IAF MD 5 further explains that the certification body should consider the composition and size of the audit team to ensure audit effectiveness. This means a client request for “only one auditor” may be considered , but it cannot simply be accepted just to reduce travel costs if that would undermine competence, coverage, or effectiveness.

Therefore:

B is correct because the OHS Manager should be told that audit duration and team make-up are decided in line with the certification body’s internal procedures .

D is correct because the request can be considered , and the certification body can respond after applying its rules and competence requirements.

Why the other options are incorrect:

A is not the best answer because the people managing the audit programme already operate within the certification body’s process.

C is inappropriate; a client request does not justify telling them to use another certification body.

E is incorrect because the accreditation body does not decide the audit team for the client’s audit.

F is incorrect because the request cannot be automatically accepted based only on cost saving.

The PDCA (Plan-Do-Check-Act) cycle is a core principle of ISO 45001 and many other management systems. It does not include environmental management, as ISO 45001 focuses on Occupational Health and Safety (OH and S), while environmental aspects are covered by ISO 14001.

Analysis of Options:

A. Treatment of Risks: Correct. Risk assessment and control are part of the Plan phase.

B. OHSMS Policy: Correct. The OH and S policy is established in the Plan phase.

C. Environment Management Program: Incorrect. This is outside the scope of ISO 45001 and pertains to ISO 14001.

D. Analyzing OHSMS Performance: Correct. Performance analysis occurs in the Check phase of the PDCA cycle.

ISO Reference:

Clause 0.3: PDCA model in ISO 45001.

A first-party audit is an internal audit . In ISO management system auditing terminology, first-party audits are performed by, or on behalf of, the organization itself to evaluate its own management system. Therefore, E. Internal audit is directly correct.

A first-party audit can also be carried out as a process audit when the organization audits one of its own processes to determine whether it is planned, implemented, maintained, and effective. Since internal audits under ISO 45001 are planned and conducted over processes, functions, and areas within the OH and S management system, D. Process audit also applies.

Why the other options are not correct:

A. Certification audit is a third-party audit , carried out by a certification body, not a first-party audit.

B. Surveillance audit is also a third-party certification body activity conducted after certification.

C. Regulatory audit is performed by a regulator or authority, not by the organization on itself.

F. External audit does not describe a first-party audit, because first-party audits are internal by definition.

Therefore, the two phrases that apply to a first-party audit are:

D, E

The two options that give the strongest cause for concern are E and F .

E. The oil on the floor might spread to other areas of the kitchen is a clear OH and S concern because the spilled oil already presents a slip hazard in the work area and could increase the risk further if it spreads. ISO 45001 requires the organization to eliminate hazards and reduce OH and S risks through operational control. A spreading oil spill shows inadequate control of a workplace hazard and poor housekeeping in an active kitchen environment.

F. Fire protection may be inadequate without adjacent safety equipment is also a strong concern. In a kitchen with hot oil, boiling water, and multiple ignition sources, the absence of visible fire extinguishers or fire blankets raises concern about the adequacy of emergency preparedness and operational control. ISO 45001 requires organizations to establish processes for emergency preparedness and response , including provision for relevant emergency equipment where needed.

Why the other options are weaker:

A is speculative and refers to the storeroom, even though the immediate issue is the unsafe condition in the kitchen.

B is an assumption about workload, not objective evidence of a system failure.

C may be true, but impurities in waste oil are not the key OH and S issue identified here.

D focuses on whether cleaning arrangements are documented, but ISO 45001 does not require every control to be a documented procedure; the stronger evidence is the unsafe condition itself.

Clause 5.4 of ISO 45001:2018 emphasizes the importance of worker consultation and participation in the OHS management system. It requires organizations to establish processes that ensure workers are actively involved in decision-making and implementation of OHS practices.

Analysis of Options:

A. Promoting collaborating workers to higher positions: While promotions may boost morale, they do not directly contribute to worker consultation and participation in the OHSMS.

B. Appointing worker representatives: This action fosters direct communication and representation of workers ' interests in health and safety matters.

C. Conducting toolbox talks on health and safety: Toolbox talks are an effective way to engage workers in discussing and addressing health and safety issues.

D. Giving ownership of health and safety matters: Involving workers in decision-making and giving them responsibility for specific health and safety tasks encourages participation.

E. Ignoring workers ' suggestions: This undermines consultation and is contrary to ISO 45001 principles.

F. Implementing a payment scheme to reward workers ' OHS performance: While incentives can motivate safe behavior, they are not a consultation or participation mechanism as required by Clause 5.4.

G. Implementing methods for engaging workers: This aligns directly with Clause 5.4, as effective engagement methods (e.g., surveys, focus groups) enhance participation.

H. Threatening reprisals to whistleblowers: This violates ISO 45001 principles and discourages worker participation.

ISO References:

Clause 5.4: Worker consultation and participation.

Clause 5.1: Leadership’s responsibility to foster participation.

ISO 45001 Clause 4.2 requires the organization to determine the relevant interested parties , their relevant needs and expectations (requirements) , and which of those become legal or other requirements for the OH and S management system. Workers are explicitly central to ISO 45001, and the standard is aimed at providing safe and healthy workplaces and preventing work-related injury and ill health. Therefore, A. Workers requiring a safe environment in which to work is clearly a relevant requirement of a relevant interested party.

ISO 45001 Annex A.4.2 lists suppliers, contractors and subcontractors among examples of interested parties. Since externally provided products and services can affect OH and S performance, a requirement linked to minimizing the risk of harm in those products and services is relevant to the OH and S management system. That is why B. Subcontractor producing products and services that minimise the risk of harm is also relevant. It aligns with the standard’s treatment of contractors/subcontractors as interested parties and with operational control over externally provided products and services that can affect OH and S.

Why the others are not correct:

C. Competitors requiring information on the organisation ' s work environment is not a relevant OH and S requirement.

D. Top management requiring an annual bonus is a financial/personal issue, not an OH and S interested-party requirement.

E. Investors requiring maximum growth in return for their capital is a business expectation, but not a relevant OH and S requirement in this context.

F. Shareholders requiring guaranteed dividend payments is also financial and not relevant to the OH and S management system, even though shareholders may be interested parties in a broader business sense. ISO 45001 requires only the needs and expectations that are relevant to the OH and SMS to be determined.

ISO 45001 emphasizes worker participation and engagement at all levels of the organization to support continuous improvement (Clause 5.4 and Clause 10.3). Continuous improvement requires input from everyone, including workers who identify hazards, report incidents, and contribute to safety enhancements.

Analysis of Options:

A. Everyone, at all levels of the company: Correct. Clause 5.4 explicitly includes all levels of the organization in consultation and participation, fostering continuous improvement.

B. Top management and senior officers only: Incorrect. While top management plays a crucial role in leadership, ISO 45001 extends the responsibility for participation to all levels.

C. Top management, senior officers, and designated safety representatives only: Incorrect. Limiting participation to designated representatives excludes a significant portion of the workforce from the improvement process.

D. Top management only: Incorrect. While top management must lead and commit to continuous improvement, their involvement alone is insufficient under ISO 45001.

ISO References:

Clause 5.4: Worker consultation and participation.

Clause 10.3: Continual improvement.

Clause 9.1.2 of ISO 45001:2018 outlines the need for organizations to evaluate compliance with applicable legal and other requirements as part of their OH and S management system.

Analysis of Options:

A. The organization must evaluate its compliance status at least once a year: The standard does not prescribe a specific frequency but states that evaluations must be conducted at planned intervals.

B. ' Other requirements ' include requirements that the organization has chosen to comply with: Correct. Other requirements may include voluntary standards, industry codes, or contractual obligations.

C. A management review is required in all instances where one or more legal requirements are not being met: This is not true. Management reviews address compliance but are not mandated for every noncompliance.

D. Every member of an audit team must have a detailed understanding of the legal requirements for the sector and type of organization they are auditing: Not true. Auditors must have general competency but can rely on subject-matter experts for legal specifics.

E. If the organization is failing to address a legal requirement relating to another discipline (e.g., Environmental management), this cannot be raised in the audit: Not true. If the legal noncompliance impacts OH and S, it can be raised.

F. The organization cannot outsource its process for evaluating compliance: The organization can outsource evaluation but retains accountability.

G. The organization is required to establish a process for evaluating compliance: Correct. Clause 9.1.2 requires a process for compliance evaluation.

H. The organization is required to evaluate its compliance status with OH and S legal and other requirements: Correct. Clause 9.1.2 explicitly states this requirement.

ISO References:

Clause 9.1.2: Evaluation of compliance.

Clause 7.5: Documented information requirements

The PDCA cycle (Plan-Do-Check-Act) is a core framework in ISO 45001 for continual improvement of the OH and S management system. An Environmental Management Program is part of ISO 14001 (Environmental Management System) and not ISO 45001.

Analysis of Options:

A. Treatment of Risks: Correct. Risk treatment is part of the Plan phase.

B. OHSMS Policy: Correct. The policy is developed in the Plan phase.

C. Environment Management Program: Incorrect. This is outside the scope of ISO 45001 and relates to ISO 14001.

D. Analyzing OHSMS Performance: Correct. Performance analysis is part of the Check phase.

ISO References:

Clause 0.3: PDCA framework in ISO 45001.