Skip to content

Evidence request lists

ISO 39001:2012 - Road Traffic Safety Management

Evidence request list. 46 controls, 46 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 11 September 2026. Published by The Art of Service.

Clause 10: Improvement

ISO-39001-10.1
Nonconformity and corrective action

Requires reaction to nonconformities and incidents, evaluation of the need for corrective action, and implementation of changes.

Artefacts an auditor will ask for
  • Lessons learned reports
  • Root cause analysis records
  • Innovation maturity reassessment
  • Updated process documentation
Where this commonly fails
  • Root cause analysis stops at symptom level
  • Feedback loops from operations back to strategy missing
  • Improvement register stale, items older than 12 months unactioned
ISO-39001-10.2
Continual improvement

Requires continual improvement of the suitability, adequacy, and effectiveness of the RTS management system.

Artefacts an auditor will ask for
  • Continual improvement register
  • Feedback loop documentation
  • Improvement initiative business cases
  • Updated process documentation
  • Root cause analysis records
Where this commonly fails
  • Lessons learned stored but never reused
  • Feedback loops from operations back to strategy missing
  • Corrective actions closed without verifying effectiveness
  • Maturity reassessment skipped year over year
  • Nonconformities not logged or trended

Clause 4: Context of the Organization

ISO-39001-4.1
Understanding the organization and its context

Requires understanding the organization's role within the road traffic system and identifying internal and external factors affecting road safety.

Artefacts an auditor will ask for
  • Stakeholder map with innovation interests
  • Market and technology radar
  • Innovation maturity baseline assessment
  • Competitor innovation benchmark
Where this commonly fails
  • Innovation maturity baseline never established
  • Stakeholder map omits external innovation partners (universities, startups)
  • Trend scanning is ad hoc and undocumented
ISO-39001-4.2
Understanding the needs and expectations of interested parties

Requires identifying interested parties and their requirements related to road traffic safety.

Artefacts an auditor will ask for
  • Innovation context register
  • Interested-party requirements log
  • Strategic intelligence brief
  • IMS scope statement signed by leadership
  • PESTEL/SWOT analysis covering innovation landscape
  • Trend and foresight scan report
Where this commonly fails
  • Trend scanning is ad hoc and undocumented
  • Stakeholder map omits external innovation partners (universities, startups)
  • Context analysis treated as one-off, not refreshed annually
  • Strategic intelligence not feeding into innovation decisions
ISO-39001-4.3
Determining the scope of the RTS management system

Requires defining the boundaries and applicability of the road traffic safety management system.

Artefacts an auditor will ask for
  • Trend and foresight scan report
  • Innovation context register
  • IMS scope statement signed by leadership
Where this commonly fails
  • Innovation maturity baseline never established
  • Strategic intelligence not feeding into innovation decisions
  • Context analysis treated as one-off, not refreshed annually
ISO-39001-4.4
RTS management system

Requires establishing, implementing, maintaining, and continually improving the RTS management system.

Artefacts an auditor will ask for
  • Trend and foresight scan report
  • Innovation maturity baseline assessment
  • Competitor innovation benchmark
Where this commonly fails
  • IMS scope undefined or inconsistent across business units
  • Trend scanning is ad hoc and undocumented
  • Stakeholder map omits external innovation partners (universities, startups)

Clause 5: Leadership

ISO-39001-5.1
Leadership and commitment

Requires top management to demonstrate leadership and commitment to the RTS management system.

Artefacts an auditor will ask for
  • RACI for innovation roles
  • Innovation governance framework
  • Leadership innovation commitments register
Where this commonly fails
  • Governance forum lacks decision-making authority
  • Culture barriers to risk-taking not addressed by leadership
  • No clear accountability for innovation outcomes
  • Innovation policy not formally approved or communicated
ISO-39001-5.2
RTS policy

Requires establishing a road traffic safety policy that provides a framework for setting RTS objectives.

Artefacts an auditor will ask for
  • Board minutes referencing innovation strategy
  • Strategic alignment matrix linking innovation to business goals
  • Executive innovation charter
  • Innovation council terms of reference
Where this commonly fails
  • Roles and responsibilities for innovation undefined
  • Innovation strategy disconnected from corporate strategy
  • Executive sponsorship limited to lip service, no time committed
  • No clear accountability for innovation outcomes
ISO-39001-5.3
Organizational roles, responsibilities and authorities

Requires assignment and communication of relevant roles, responsibilities, and authorities for RTS.

Artefacts an auditor will ask for
  • Innovation vision and strategy document
  • Culture assessment results
  • Board minutes referencing innovation strategy
  • Executive innovation charter
  • Leadership innovation commitments register
  • Strategic alignment matrix linking innovation to business goals
Where this commonly fails
  • Innovation strategy disconnected from corporate strategy
  • Governance forum lacks decision-making authority
  • Executive sponsorship limited to lip service, no time committed

Clause 6: Planning

ISO-39001-6.1
Actions to address risks and opportunities

Requires identifying risks and opportunities related to road traffic safety and planning actions to address them.

Artefacts an auditor will ask for
  • Innovation portfolio dashboard
  • Action plans tied to innovation objectives
  • Risk treatment plan
  • Innovation roadmap
  • Resource allocation plan
Where this commonly fails
  • Innovation objectives lack measurable targets
  • Initiative prioritisation done by HiPPO not criteria
  • Portfolio biased toward horizon 1 incremental projects
  • Risk treatment plans absent for high-uncertainty bets
  • Opportunities and risks tracked separately with no link to objectives
ISO-39001-6.2
RTS performance factors

Requires identifying RTS performance factors that the organization can influence, such as speed, vehicle condition, and road use.

Artefacts an auditor will ask for
  • Portfolio balancing model (horizons 1/2/3)
  • Innovation portfolio dashboard
  • Opportunity and risk register
  • Risk treatment plan
Where this commonly fails
  • Opportunities and risks tracked separately with no link to objectives
  • Roadmap not updated when strategy changes
  • Portfolio biased toward horizon 1 incremental projects
ISO-39001-6.3
RTS objectives and planning to achieve them

Requires establishing measurable RTS objectives with targets, responsibilities, timeframes, and resources.

Artefacts an auditor will ask for
  • Initiative prioritisation scorecard
  • Action plans tied to innovation objectives
  • Risk treatment plan
  • Opportunity and risk register
  • Innovation roadmap
  • Change management plan for innovation initiatives
Where this commonly fails
  • Initiative prioritisation done by HiPPO not criteria
  • Roadmap not updated when strategy changes
  • Innovation objectives lack measurable targets
  • No resource plan tied to portfolio priorities
  • Opportunities and risks tracked separately with no link to objectives

Clause 7: Support

ISO-39001-7.1
Resources

Requires determining and providing resources needed for the establishment, implementation, and improvement of the RTS system.

Artefacts an auditor will ask for
  • IP register and assignment agreements
  • Partnership and collaboration agreements
  • Resource and budget plan for innovation
Where this commonly fails
  • Partnership agreements lack IP and confidentiality clauses
  • Knowledge from past projects not captured or reused
  • Strategic intelligence siloed in one team
ISO-39001-7.2
Competence

Requires ensuring persons performing work affecting RTS performance have the necessary competence.

Artefacts an auditor will ask for
  • Strategic intelligence repository
  • Competence matrix for innovation roles
  • IP register and assignment agreements
  • Document control register for IMS
  • Knowledge repository / lessons learned database
Where this commonly fails
  • Innovation budget not ring-fenced from operating budget
  • Competence requirements for innovation roles not defined
  • Time allocation for innovation crowded out by BAU
  • IP register incomplete, ownership disputes likely
  • Knowledge from past projects not captured or reused
ISO-39001-7.3
Awareness

Requires persons performing work under the organization's control to be aware of the RTS policy and their contribution.

Artefacts an auditor will ask for
  • Resource and budget plan for innovation
  • Training records and learning paths
  • Document control register for IMS
  • Time-allocation policy (e.g., 10% innovation time)
Where this commonly fails
  • Innovation budget not ring-fenced from operating budget
  • Knowledge from past projects not captured or reused
  • Partnership agreements lack IP and confidentiality clauses
  • Tools and methods inconsistent across teams
ISO-39001-7.4
Communication

Requires determining internal and external communications relevant to the RTS management system.

Artefacts an auditor will ask for
  • Knowledge repository / lessons learned database
  • Innovation tools and methods catalogue
  • Communication plan (internal/external)
Where this commonly fails
  • Tools and methods inconsistent across teams
  • Knowledge from past projects not captured or reused
  • Innovation budget not ring-fenced from operating budget
ISO-39001-7.5
Documented information

Requires creation, updating, and control of documented information required by the RTS management system.

Artefacts an auditor will ask for
  • Innovation infrastructure inventory
  • IP register and assignment agreements
  • Resource and budget plan for innovation
  • Strategic intelligence repository
  • Communication plan (internal/external)
  • Innovation tools and methods catalogue
Where this commonly fails
  • Time allocation for innovation crowded out by BAU
  • Tools and methods inconsistent across teams
  • Partnership agreements lack IP and confidentiality clauses

Clause 8: Operation

ISO-39001-8.1
Operational planning and control

Requires planning, implementing, and controlling processes needed to meet RTS requirements and implement actions from planning.

Artefacts an auditor will ask for
  • Setpoint and operating window register
  • Shift handover logs covering energy
  • Change management records affecting energy
Where this commonly fails
  • Operating criteria not documented for SEUs
  • Maintenance focused on uptime not energy
  • Setpoints drift between shifts
  • Outsourced providers have no energy obligations
  • Change management bypasses energy review
ISO-39001-8.2
Emergency preparedness and response

Requires establishing and maintaining processes for potential emergency situations and responding to actual emergencies on roads.

Artefacts an auditor will ask for
  • Specification checklist for energy efficient equipment
  • Commissioning records validating energy performance
  • Design review minutes covering energy
  • Design brief template with energy criteria
  • Capex business case template requiring EnPI impact
Where this commonly fails
  • Design briefs silent on energy
  • Commissioning does not verify energy performance
  • No life cycle cost analysis

Clause 9: Performance Evaluation

ISO-39001-9.1
Monitoring, measurement, analysis and evaluation

Requires determining what needs to be monitored and measured to evaluate RTS performance and system effectiveness.

Artefacts an auditor will ask for
  • Innovation KPI dashboard
  • Performance evaluation criteria document
  • Benchmarking study results
Where this commonly fails
  • KPIs measure activity (idea count) not outcomes (revenue, adoption)
  • Evaluation criteria differ across portfolio without rationale
  • Management reviews skip innovation as an agenda item
  • Benchmarking against peers absent
ISO-39001-9.2
Internal audit

Requires conducting internal audits at planned intervals to confirm the RTS management system conforms to requirements.

Artefacts an auditor will ask for
  • Performance evaluation criteria document
  • Innovation KPI dashboard
  • Management review minutes and actions
Where this commonly fails
  • Customer feedback not systematically captured
  • Benchmarking against peers absent
  • Lagging indicators only, no leading indicators
ISO-39001-9.3
Management review

Requires top management review of the RTS system for continuing suitability, adequacy, and effectiveness.

Artefacts an auditor will ask for
  • Balanced scorecard for innovation
  • Audit nonconformity log
  • Innovation KPI dashboard
  • Management review minutes and actions
  • Internal audit programme and reports
  • Innovation analytics report
Where this commonly fails
  • Internal audits of IMS not scheduled
  • Customer feedback not systematically captured
  • KPIs measure activity (idea count) not outcomes (revenue, adoption)
  • Evaluation criteria differ across portfolio without rationale

Context

ISO39001-4.1
Understanding the Organization and Its Context

Determine external and internal issues relevant to the RTS management system, including road traffic environment and stakeholder concerns.

Artefacts an auditor will ask for
  • RTS context analysis
  • Fleet and route environment summary
  • Regulatory landscape review
Where this commonly fails
  • Context limited to own fleet, ignores wider road users
ISO39001-4.2
Needs and Expectations of Interested Parties

Identify interested parties relevant to RTS performance and their requirements.

Artefacts an auditor will ask for
  • Stakeholder register including road authorities, emergency services, drivers, vulnerable road users
Where this commonly fails
  • Vulnerable road users omitted

Improvement

ISO39001-10.1
Nonconformity and Corrective Action

Act on nonconformities including incidents, determine causes, and implement corrective action.

Artefacts an auditor will ask for
  • NC register
  • Root cause analyses
  • Verified effectiveness records
Where this commonly fails
  • Effectiveness not verified
ISO39001-10.2
Continual Improvement

Continually improve the suitability, adequacy, and effectiveness of the RTSMS.

Artefacts an auditor will ask for
  • Improvement initiatives log
  • Benchmarking against industry KSI rates
Where this commonly fails
  • No benchmarking

Leadership

ISO39001-5.1
Leadership and Commitment

Top management demonstrates leadership for RTS performance and the long-term goal of eliminating death and serious injury.

Artefacts an auditor will ask for
  • Safe System / Vision Zero commitment statement
  • Board minutes referencing RTS
  • Executive RTS sponsor designation
Where this commonly fails
  • No explicit long-term goal of elimination

Management System

ISO39001-4.4
RTS Management System

Establish, document, implement, maintain, and continually improve an RTS management system.

Artefacts an auditor will ask for
  • RTS manual or equivalent
  • Process map
  • Scope statement
Where this commonly fails
  • Scope excludes contractor fleets

Operations

ISO39001-8.1
Operational Planning and Control

Plan, implement, and control operational processes needed to meet RTS requirements.

Artefacts an auditor will ask for
  • Journey management procedure
  • Vehicle scheduling controls
  • Loading and securing procedures
Where this commonly fails
  • No journey risk assessment for high-risk routes
ISO39001-8.2
Emergency Preparedness and Response

Establish processes to prepare for and respond to RTS emergencies including crashes.

Artefacts an auditor will ask for
  • Crash response procedure
  • Emergency contact cards in vehicles
  • Drill records
Where this commonly fails
  • No drills conducted

Performance

ISO39001-9.1
Monitoring, Measurement, Analysis, and Evaluation

Monitor RTS performance using output, intermediate, and final outcome indicators.

Artefacts an auditor will ask for
  • KSI rate per million km
  • Near-miss reporting data
  • Telematics dashboards
  • Audit findings
Where this commonly fails
  • Only lagging indicators tracked
ISO39001-9.1.Crash
Crash and Other RTS Incident Investigation

Investigate crashes and RTS incidents to identify causes and prevent recurrence.

Artefacts an auditor will ask for
  • Investigation procedure
  • Case files with root cause
  • Corrective action records
Where this commonly fails
  • Investigations stop at driver blame
ISO39001-9.2
Internal Audit

Conduct internal audits of the RTSMS at planned intervals.

Artefacts an auditor will ask for
  • Audit programme
  • Reports
  • Auditor competence records
Where this commonly fails
  • Audits not RTS-specific
ISO39001-9.3
Management Review

Top management reviews the RTSMS at planned intervals.

Artefacts an auditor will ask for
  • Review minutes including KSI trends and actions
Where this commonly fails
  • No review of long-term goal progress

Planning

ISO39001-6.2
RTS Performance Factors

Identify RTS performance factors influencing exposure, crashes, and outcomes including safe roads, vehicles, road users, speeds, and post-crash response.

Artefacts an auditor will ask for
  • Documented RTS performance factors mapped to Safe System pillars
  • Exposure data (km driven, hours, trips)
  • Crash rate analysis
Where this commonly fails
  • Only output factors tracked, no risk exposure factors
ISO39001-6.3
RTS Objectives and Planning

Establish RTS objectives consistent with the RTS policy and plan to achieve them.

Artefacts an auditor will ask for
  • Objectives register with KSI reduction targets
  • Action plans with owners and dates
Where this commonly fails
  • Objectives not linked to KSI reduction

Policy

ISO39001-5.2
RTS Policy

Establish an RTS policy reflecting the long-term elimination goal and commitment to a Safe System approach.

Artefacts an auditor will ask for
  • Signed RTS policy
  • Distribution records
  • Worker acknowledgment evidence
Where this commonly fails
  • Policy generic, not RTS specific

Safe System

ISO39001-6.2.PostCrash
Post-Crash Response

Plan and prepare for response to crashes including emergency response, victim support, and investigation.

Artefacts an auditor will ask for
  • Crash response procedure
  • First responder training records
  • Victim support process
  • Crash investigation reports
Where this commonly fails
  • No post-crash victim support pathway
ISO39001-6.2.SafeRoadUsers
Safe Road Users

Address driver competence, fitness, fatigue, distraction, impairment, and behavior.

Artefacts an auditor will ask for
  • Driver licensing checks
  • Fitness-to-drive assessments
  • Fatigue management plan
  • Mobile phone / distraction policy
Where this commonly fails
  • Driver licence checks one-off at hire
ISO39001-6.2.SafeRoads
Safe Roads and Roadsides

Address road and roadside design, layout, condition, and signage as RTS factors.

Artefacts an auditor will ask for
  • Route risk assessment
  • Roadside hazard inventory
  • Engagement with road authorities
Where this commonly fails
  • No route-level risk scoring
ISO39001-6.2.SafeSpeeds
Safe Speeds

Manage speed as a key RTS performance factor including speed limits, in-vehicle monitoring, and compliance.

Artefacts an auditor will ask for
  • Speed policy
  • Telematics speed reports
  • Speed violation investigation records
Where this commonly fails
  • No telematics
  • Speeding incidents not investigated
ISO39001-6.2.SafeVehicles
Safe Vehicles

Specify, procure, and maintain vehicles to maximize occupant and other road user safety.

Artefacts an auditor will ask for
  • Vehicle safety specification (NCAP rating thresholds, ADAS requirements)
  • Maintenance schedule and records
  • Pre-use checks
Where this commonly fails
  • No minimum safety specification for procurement

Support

ISO39001-7.2
Competence

Determine and ensure RTS-related competence for persons whose work affects RTS performance.

Artefacts an auditor will ask for
  • Driver competence matrix
  • Defensive driving training records
  • Licence category verification
Where this commonly fails
  • No periodic refresher
ISO39001-7.3
Awareness

Ensure awareness of RTS policy, contributions, and consequences of non-compliance.

Artefacts an auditor will ask for
  • Driver toolbox talks
  • RTS awareness campaign materials
Where this commonly fails
  • Awareness only at induction
ISO39001-7.4
Communication and Coordination

Communicate and coordinate with internal and external parties on RTS matters including contractors and road authorities.

Artefacts an auditor will ask for
  • Communication plan
  • Contractor RTS briefings
  • Engagement records with road authorities
Where this commonly fails
  • No contractor briefings
ISO39001-7.5
Documented Information

Maintain documented information required by the RTSMS.

Artefacts an auditor will ask for
  • Document register
  • Version control
  • Driver handbook
Where this commonly fails
  • Driver handbook outdated
Assembled from the framework's own control set. Every line traces to a control in the graph, so this pack is regenerated rather than written, and stays current as the graph does.

Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does.