Free PECB ISO-45001-Lead-Auditor Practice Exam with Questions & Answers

ISO 45001 Clause 8.1.3 Management of change states that the organization must establish processes for the implementation and control of planned temporary and permanent changes that impact OH and S performance . It also says this includes new products, services and processes , and changes to existing products, services and processes . That makes A true. It also supports B , because the clause is specifically about changes that impact the organization’s OH and S performance .

Statement E is also true. If the organization decides, after an emergency preparedness and response exercise, that it needs to change part of the OHSMS to improve OH and S performance, then that change has to be implemented in a controlled way under the organization’s management-of-change process. ISO 45001 links emergency preparedness with improvement and requires changes impacting OH and S performance to be controlled.

Why the others are false:

C is false because ISO 45001 does not limit management of change to planned changes only. It says the organization must also review the consequences of unintended changes and take action to mitigate adverse effects.

D is false because Clause 8.1.3 does not require retaining documented information of all changes . The clause requires establishing processes for implementation and control, but it does not state a blanket requirement to retain documented information for every change.

F is false because developments in knowledge and technology are explicitly included in management of change, not excluded.

G is false because changes are not limited to those identified by the organization itself; the clause also includes changes in legal and other requirements , and changes in knowledge or information about hazards and risks .

H is false because ISO 45001 explicitly says management of change applies to temporary and permanent planned changes.

Clause 5.2 of ISO 45001:2018 outlines requirements for the OH and S policy, emphasizing commitment to continual improvement, compliance with legal requirements, and communication of the policy to interested parties.

Analysis of Options:

A. The management is committed to health and safety improvement: Correct. The policy explicitly states the organization’s commitment to improvement, meeting Clause 5.2 requirements.

C. The organization has a good reputation for safe experiences: Not relevant to ISO 45001 requirements; reputation is not a policy criterion.

D. The organization intends to communicate its policy to external parties: Correct. Clause 5.2 requires the policy to be communicated to interested parties.

E. The organization is committed to continual health and safety improvement: Correct. This directly aligns with Clause 5.2, which mandates continual improvement.

F. The organization meets all statutory requirements: The policy does not explicitly state compliance with legal requirements, even though this is implied.

G. The organization satisfies its customers’ health and safety requirements: The policy does not specifically address customer requirements.

H. The organization uses contractors committed to health and safety: Not stated in the policy.

I. The organization’s processes deliver the intended improvement to health and safety: This is not evident from the policy statement.

ISO References:

Clause 5.2: OH and S policy.

According to ISO 45001:2018, the PDCA cycle is explained in Clause 0.4. The Act phase is defined as: taking actions to improve continually the OH and S performance in order to achieve the intended outcomes . This clearly supports C. Making improvements as a correct answer.

Option D. Resetting objectives is also appropriate because ISO 45001 requires OH and S objectives to be reviewed and updated as appropriate . After checking performance results, the organization may revise or reset objectives as part of continual improvement and corrective action. This aligns with the Act stage, where changes are made to improve system effectiveness and performance.

The remaining options belong to other PDCA phases:

A. Verifying training relates more to evaluation of competence and effectiveness, which fits checking activities.

B. Measuring objectives belongs to the Check phase because ISO 45001 says Check includes monitoring and measurement against OH and S policy and objectives.

E. Providing infrastructure belongs to the Do phase because it is part of providing resources and operational support.

F. Auditing processes belongs to the Check phase because internal audits are part of performance evaluation under Clause 9.2.

Therefore, the correct answer is:

C, D

The PDCA cycle (Plan-Do-Check-Act) is a core framework in ISO 45001 for continual improvement of the OH and S management system. An Environmental Management Program is part of ISO 14001 (Environmental Management System) and not ISO 45001.

Analysis of Options:

A. Treatment of Risks: Correct. Risk treatment is part of the Plan phase.

B. OHSMS Policy: Correct. The policy is developed in the Plan phase.

C. Environment Management Program: Incorrect. This is outside the scope of ISO 45001 and relates to ISO 14001.

D. Analyzing OHSMS Performance: Correct. Performance analysis is part of the Check phase.

ISO References:

Clause 0.3: PDCA framework in ISO 45001.

The correct answer is A .

This is a serious attempted bribe and a direct threat to audit integrity, impartiality, and credibility . A third-party auditor must not accept gifts, inducements, or favorable treatment in exchange for changing, hiding, or weakening audit findings. The auditor must act ethically and protect the certification process from improper influence.

The organization has also failed to implement the agreed corrective action , so that failure must be recorded accurately. Any attempt to conceal it would be dishonest and would invalidate the audit outcome. In certification auditing, impartiality and objective evidence are fundamental principles. An offer of discounted personal work in exchange for suppressing an audit finding is unacceptable and must be escalated.

Therefore, the correct response is to:

stop the audit activity , because the integrity of the audit has been compromised;

leave the site ;

report the attempted bribe immediately to the individual(s) managing the audit programme or certification body;

avoid further direct contact with the auditee until instructions are given.

Why the other options are wrong:

B is unethical because it ignores both the failed corrective action and the attempted bribe.

C is fraudulent because it involves knowingly recording false audit information and accepting the improper benefit.

D is also unethical because it accepts the benefit indirectly and delays the audit to help the auditee avoid the finding.

The best responses are D, E, and G .

D. Insist that the nonconformities must stand since there is clear evidence for them apart from the videos is correct because audit findings and nonconformities must be based on objective evidence . If the evidence supporting the findings exists independently of the videos, then the findings should not be rescinded simply because there is a dispute about how supplementary material was recorded. A problem with auditor conduct or site permission does not automatically invalidate valid audit evidence already obtained.

E. Advise the OHS Manager that they should speak to the supervisor to confirm the situation is also appropriate because the auditor stated that permission had been obtained from a supervisor who was part of the safety team. Before taking action, the audit team leader should verify the facts. This is a reasonable and proportionate response to clarify whether site permission was actually granted.

G. Indicate that he, as audit team leader, will seek approval for the taking of videos by auditors at the opening meetings with management at all audits in the future is appropriate because it addresses the control weakness going forward. Audit teams should be clear about site rules, confidentiality, and permissions for photographs or videos before audit activities begin. This is a constructive preventive action for future audits.

Why the other options are not the best:

A may be premature until the facts are verified.

B assumes misconduct before confirming the facts.

C is incorrect because auditors do not inherently “must” take videos.

F is too severe before the situation is properly established and investigated.

H is inappropriate because the audit team leader should not personally handle or manipulate the auditor’s personal phone.

2. Prepare the audit checklist, 3. Obtain objective evidence, 4. Review audit evidence, 5. Document findings

For a first-party audit, the sequence follows the normal audit flow described in ISO auditing guidance: first the audit is initiated and leadership is assigned, then audit activities are prepared, then evidence is collected during the audit, then that evidence is evaluated, then findings are recorded, and finally the audit report is issued. ISO 19011 describes the audit flow as initiating the audit, preparing audit activities, conducting audit activities, and preparing and distributing the audit report. ( ISO )

That is why, after 1. Appoint an audit team leader , the next correct step is 2. Prepare the audit checklist . The checklist is part of preparing for the audit and helps the auditor plan questions, clauses, process interactions, and sampling points before going on to collect evidence. ( WEDEAQ | Official VDA QMC Partner )

After preparation, the auditor moves to 3. Obtain objective evidence . Audit evidence is gathered through interviews, observation, and review of documented information during the audit. This is a core activity of conducting the audit. ( DNV )

Once evidence is collected, the auditor must 4. Review audit evidence . ISO audit practice requires the evidence to be evaluated against the audit criteria to determine whether conformity or nonconformity exists. Evidence is not simply collected and reported immediately; it is first reviewed and assessed. ( PRETESH BISWAS )

After reviewing the evidence, the auditor can 5. Document findings . Findings are the result of evaluating the evidence against criteria, so they logically come after evidence review. Recorded findings can include conformity, nonconformity, and opportunities for improvement, depending on the audit plan and method. ( PRETESH BISWAS )

The final step is 6. Issue the report , because the report is prepared only after the audit evidence has been reviewed and the findings have been determined and documented. ( ISO )

So, the correct full order is:

1. Appoint an audit team leader

2. Prepare the audit checklist

3. Obtain objective evidence

4. Review audit evidence

5. Document findings

6. Issue the report

ISO 45001 Clause 4.2 requires the organization to determine the relevant interested parties , their relevant needs and expectations (requirements) , and which of those become legal or other requirements for the OH and S management system. Workers are explicitly central to ISO 45001, and the standard is aimed at providing safe and healthy workplaces and preventing work-related injury and ill health. Therefore, A. Workers requiring a safe environment in which to work is clearly a relevant requirement of a relevant interested party.

ISO 45001 Annex A.4.2 lists suppliers, contractors and subcontractors among examples of interested parties. Since externally provided products and services can affect OH and S performance, a requirement linked to minimizing the risk of harm in those products and services is relevant to the OH and S management system. That is why B. Subcontractor producing products and services that minimise the risk of harm is also relevant. It aligns with the standard’s treatment of contractors/subcontractors as interested parties and with operational control over externally provided products and services that can affect OH and S.

Why the others are not correct:

C. Competitors requiring information on the organisation ' s work environment is not a relevant OH and S requirement.

D. Top management requiring an annual bonus is a financial/personal issue, not an OH and S interested-party requirement.

E. Investors requiring maximum growth in return for their capital is a business expectation, but not a relevant OH and S requirement in this context.

F. Shareholders requiring guaranteed dividend payments is also financial and not relevant to the OH and S management system, even though shareholders may be interested parties in a broader business sense. ISO 45001 requires only the needs and expectations that are relevant to the OH and SMS to be determined.