Free PECB ISO-45001-Lead-Auditor Practice Exam with Questions & Answers | Set: 3

Opportunities for improvement (OFIs) are suggestions provided during audits that do not indicate nonconformities but are aimed at enhancing the system’s performance.

Analysis of Options:

A. A quality control program could involve non-destructive testing of the welded handrails: While beneficial, this focuses on product quality rather than OH and S improvements.

B. Operational planning activities may benefit from an improved risk-based approach based on international standards for risk management: Correct. Enhancing risk-based thinking aligns with Clause 6.1.1.

C. A first aid station could be located next to the handrail polishing operation: While useful, first aid station placement is an operational matter, not directly related to OH and S management system improvement.

D. Additional internal audits of the OHS management system may reduce production problems: Internal audits should address system performance, not production problems.

F. The induction program for new employees could include an awareness training video on health and safety: Correct. Enhanced training for new employees addresses Clause 7.2 (competence).

G. The requirement for wearing protective gloves could be extended to shop floor workers across all operations: Correct. This improves hazard control in line with Clause 8.1.2.

H. The molding polishers should be disciplined for incompetency: Disciplinary actions are outside the scope of system improvement.

ISO References:

Clause 6.1.1: Risk management.

Clause 7.2: Competence.

Clause 8.1.2: Hierarchy of controls.

The correct responses are C and D .

Certification bodies are required to have documented procedures for determining audit time and to determine the time needed to plan and accomplish a complete and effective audit . Audit duration is not something that can simply be shortened because the client asks for less disruption. ISO/IEC 17021-1 requires the certification body to determine audit time through its documented process, and the justification for the duration must be recorded. ( IAS )

IAF MD 5 also states that certification bodies shall identify the audit time for each client and that this framework is used within the certification body’s processes to determine the appropriate audit time , taking into account the specifics of the client organization. That means the request may be considered , but it does not have to be accepted. ( IAF )

Therefore:

C. Advise that his request will be considered but may not be taken up is correct, because the certification body can review the request, but the final decision must still comply with its audit-time rules and adequacy requirements. ( IAF )

D. Advise the OHS Manager that the audit duration and team make-up will be decided in line with the internal procedures of the certification body is correct, because ISO/IEC 17021-1 requires the certification body to use documented procedures for audit time and team decisions. ( IAS )

Why the other options are incorrect:

A is inappropriate because the request is not automatically a reason to tell the client to choose another certification body.

B is incorrect because the request cannot simply be accepted without following the certification body’s rules. ( IAS )

E is too absolute; the request should be considered against the certification body’s requirements, not rejected automatically. ( IAF )

F is unnecessary because the people managing the audit programme already have the responsibility to handle such matters through the certification body’s procedures. ( IAS )

ISO 45001:2018 Clause 9.3.3 states that the outputs of management review shall include decisions related to:

the continued suitability, adequacy and effectiveness of the OH and S management system,

opportunities for continual improvement ,

any need for changes to the OH and S management system ,

resources needed ,

actions, if needed,

opportunities to improve integration of the OH and S management system with other business processes, and

any implications for the strategic direction of the organization.

Based on that, the six correct outputs are:

B. Procurement of new safety harnesses for workers

This is evidence of an action/resource decision arising from management review. It shows management has decided to provide resources or take action to improve OH and S performance.

D. Allocation of a bigger budget for the OHS department

This clearly matches resources needed , which is specifically listed as a management review output.

E. Plan to prioritise health and safety issues as a business strategy

This fits implications for the strategic direction of the organization , which ISO 45001 names as a management review output.

F. Decisions related to continual improvement opportunities

This is almost verbatim from Clause 9.3.3: management review outputs include decisions related to opportunities for continual improvement .

G. Improvements in the OHSMS

This reflects changes needed in the OH and S management system and resulting improvement actions. Where management review decisions lead to system improvements, those improvements are valid output evidence from the review.

J. Opportunities to integrate the OHS management system with other business processes

This is directly stated in Clause 9.3.3 as a required management review output.

Why the other four are not outputs:

A. Report showing the trend of an increase in safety incidents is an input to management review under performance information and trends, not an output.

C. Minutes of previous management reviews are also an input , because management review must consider the status of actions from previous reviews.

H. Worker feedback of positive and negative comments is an input , linked to consultation, participation, and relevant communications.

I. Updates to the risk register may result from actions elsewhere in the system, but they are not specifically identified in ISO 45001 as required management review outputs.

Therefore, the six statements that represent output audit evidence for management review are:

B, D, E, F, G, J

Explanation

Prepares the audit report → Audit Team Leader: The Audit Team Leader is responsible for compiling and preparing the final audit report, summarizing findings and conclusions.

Prepares audit checklists for use during the audit → Auditor: Auditors create checklists to ensure a thorough and systematic evaluation during the audit.

Participates under the direction and guidance of an auditor → Auditor in Training: An auditor in training works under supervision to gain experience and contribute to the audit process.

Follows up on audit findings within an agreed timeframe → Auditee: The auditee is responsible for addressing and resolving audit findings and providing evidence of corrective actions.

A person who accompanies the audit team but does not act as an auditor → Observer: Observers are typically external parties or internal personnel who watch the audit process but do not participate actively.

Escorts the auditors but does not participate in the audit → Guide: A guide facilitates the audit by helping auditors navigate the site and access relevant areas or documents.

References

ISO 19011:2018: Guidelines for auditing management systems.

ISO 45001 requires an organization to determine the external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended results of the OH and S management system. This is established in Clause 4.1 – Understanding the organization and its context . External issues are typically conditions arising outside the organization, such as market conditions, social conditions, legal environment, economic factors, and technological developments. Internal issues are those related to the organization’s people, structure, culture, ownership, competence, and operational arrangements.

D. New technology available on the market is an external issue because it exists in the external business and technological environment. It is not created inside the organization, but it can affect how the organization manages OH and S risks and opportunities, for example by introducing safer equipment, automation, or new control methods. ISO 45001 guidance in Annex A recognizes that technological environment can be part of context analysis.

F. Average salaries in the business sector is also an external issue because it relates to the wider economic and labor-market environment, not the organization’s own internal arrangements. This kind of issue can influence recruitment, retention, competence availability, and worker welfare conditions, all of which may indirectly affect OH and S performance. It is part of the external economic context.

Why the other options are not external:

A. Increased number of outsourced processes is mainly an internal organizational decision about how work is arranged and controlled. Although outsourced providers are external parties, the increase in outsourcing is part of the organization’s internal operating model.

B. New owners of the organisation is an internal issue because ownership and governance are part of the organization’s internal structure and direction.

C. Workers joined a trade union is generally treated as an internal workforce/industrial relations issue , because it directly concerns the organization’s workers and participation arrangements.

E. Recently hired workers with limited command of the local language is an internal issue because it concerns the competence, communication, and workforce characteristics within the organization.

Therefore, the two options related to external issues are:

D, F

Analysis of Options:

A. The organisation must attempt to identify and address every risk it faces: Incorrect. ISO 45001 focuses on OH and S risks and not every risk faced by the organization.

B. The effect of uncertainty (i.e. risk) can result in positive outcomes as well as negative ones: Correct. Clause 3.20 defines risk as the " effect of uncertainty, " which may result in positive or negative outcomes.

C. Although organisations are required to carry out risk management, the method by which they do so is up to them: Correct. ISO 45001 does not prescribe specific risk management methods, leaving the organization to choose the approach that best suits its context (Clause 6.1.2).

D. Risk assessment is an activity that must be carried out by top management: Incorrect. Risk assessment can involve workers and other personnel; it is not limited to top management.

E. The organisation is required to assess risks arising from OH and S hazards: Correct. Clause 6.1.2.2 requires organizations to assess OH and S risks associated with hazards.

F. Risk is often expressed as a combination of likelihood and impact: Correct. This is a common way to express risk, aligned with Clause 6.1.2.

ISO References:

Clause 3.20: Definition of risk.

Clause 6.1.2: Hazard identification and risk assessment

The correct answer is A. Audit findings that pose a significant health and safety risk.

In management system auditing practice, the audit team leader is expected to maintain communication with the auditee during the audit, especially when serious issues are identified. Where audit evidence indicates a significant risk , this should be communicated without waiting for the closing meeting , so the organization can take prompt action if needed. ISO guidance on conducting audits emphasizes communication during the audit and presentation of findings and conclusions at the closing meeting, while serious risks are handled immediately rather than being delayed. ( ISO )

Why the other options are not correct:

B. The outcome of the audit, including the conclusion is normally communicated at the closing meeting , not before it. ( Advisera )

C. Diverging opinions within the audit team are internal audit team matters. Only unresolved issues relevant to audit results may be raised appropriately, but internal team differences are not the key information to communicate beforehand.

D. Performance of individual workers when responding to health and safety-related questions is not the purpose of audit reporting. A management system audit evaluates the system and its implementation, not individual worker appraisal.

Therefore, the information that should be communicated to the auditee before the closing meeting is:

A. Audit findings that pose a significant health and safety risk.