ISO 45001
Evidence request list. 39 controls, 39 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 11 September 2026. Published by The Art of Service.
Context
Determine external and internal issues relevant to OH&S management system purpose and ability to achieve intended outcomes.
- PESTLE/SWOT for OH&S
- Context register
- Strategic OH&S issues log
- No OH&S-specific context
- Stale issue list
Identify workers and other interested parties and determine their relevant needs, expectations and which become compliance obligations.
- Interested party register
- Worker consultation records
- Compliance obligations register
- Contractors omitted
- No worker rep input
Define boundaries and applicability of OH&S MS including activities, products, services and workplaces under organizational control.
- Documented OH&S MS scope
- Site/activity list
- Exclusion rationale
- Mobile workers excluded
- Contractor scope vague
ISO 45001: OH&S Policy & Planning
OH&S policy and commitment. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.
- OH&S policy statement
- Hazard register
- Legal register
- Worker consultation records
- Stale hazard inventory
- Missing legal updates
- Token consultation
- Objectives without measures
Hazard identification and risk assessment. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.
- OH&S policy statement
- Hazard register
- Legal register
- Worker consultation records
- Stale hazard inventory
- Missing legal updates
- Token consultation
- Objectives without measures
Legal and regulatory compliance. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.
- OH&S policy statement
- Hazard register
- Legal register
- Worker consultation records
- Stale hazard inventory
- Missing legal updates
- Token consultation
- Objectives without measures
OH&S objectives and action plans. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.
- OH&S policy statement
- Hazard register
- Legal register
- Worker consultation records
- Stale hazard inventory
- Missing legal updates
- Token consultation
- Objectives without measures
Worker consultation and participation. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.
- OH&S policy statement
- Hazard register
- Legal register
- Worker consultation records
- Stale hazard inventory
- Missing legal updates
- Token consultation
- Objectives without measures
ISO 45001: Operational Controls
Elimination and substitution of hazards. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.
- OH&S policy statement
- Hazard register
- Legal register
- Worker consultation records
- Stale hazard inventory
- Missing legal updates
- Token consultation
- Objectives without measures
Engineering and administrative controls. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.
- Control hierarchy register
- PPE issue log
- Emergency response plan
- Contractor safety pack
- PPE as first resort
- Untested emergency drills
- No contractor onboarding
- Missing control review cycle
Personal protective equipment management. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.
- Incident investigation report
- OH&S audit plan
- Management review minutes
- Corrective action register
- Root cause not identified
- Audit findings not closed
- No trend analysis
- Lessons not shared
Emergency preparedness and response. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.
- Control hierarchy register
- PPE issue log
- Emergency response plan
- Contractor safety pack
- PPE as first resort
- Untested emergency drills
- No contractor onboarding
- Missing control review cycle
Contractor and visitor safety management. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.
- Control hierarchy register
- PPE issue log
- Emergency response plan
- Contractor safety pack
- PPE as first resort
- Untested emergency drills
- No contractor onboarding
- Missing control review cycle
ISO 45001: Performance & Improvement
Incident investigation and reporting. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.
- Incident investigation report
- OH&S audit plan
- Management review minutes
- Corrective action register
- Root cause not identified
- Audit findings not closed
- No trend analysis
- Lessons not shared
OH&S monitoring and measurement. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.
- Incident investigation report
- OH&S audit plan
- Management review minutes
- Corrective action register
- Root cause not identified
- Audit findings not closed
- No trend analysis
- Lessons not shared
Internal OH&S audit program. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.
- Incident investigation report
- OH&S audit plan
- Management review minutes
- Corrective action register
- Root cause not identified
- Audit findings not closed
- No trend analysis
- Lessons not shared
Management review and continual improvement. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.
- Incident investigation report
- OH&S audit plan
- Management review minutes
- Corrective action register
- Root cause not identified
- Audit findings not closed
- No trend analysis
- Lessons not shared
Corrective actions and lessons learned. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.
- Incident investigation report
- OH&S audit plan
- Management review minutes
- Corrective action register
- Root cause not identified
- Audit findings not closed
- No trend analysis
- Lessons not shared
Improvement
Establish processes for reporting, investigating and taking action to control and correct incidents and nonconformities.
- Incident reports
- Root cause analyses
- ICAM/TapRooT records
- CAPA register
- Blame-focused investigation
- Near-miss under-reported
Continually improve suitability, adequacy and effectiveness of OH&S MS to enhance OH&S performance.
- Improvement initiative register
- Trend analysis
- Best practice sharing
- Status quo bias
- No benchmarking
Leadership
Top management demonstrates leadership for OH&S MS including taking accountability for prevention of work-related injury and ill health.
- CEO OH&S statement
- Management review minutes
- Visible felt leadership records
- Delegated to HSE only
- No site walks
Establish, implement and maintain OH&S policy with commitments to safe and healthy working conditions, hazard elimination and worker consultation.
- Signed OH&S policy
- Communication evidence
- Policy review log
- Missing consultation commitment
- Not communicated to contractors
Assign and communicate responsibilities and authorities for relevant roles in the OH&S MS.
- RACI for OH&S
- Position descriptions
- Org chart with OH&S roles
- No worker-level accountability
- HSE manager bottleneck
Establish processes for consultation and participation of workers, including non-managerial workers, at all applicable levels.
- HSE committee minutes
- Toolbox talk records
- Suggestion system stats
- Token committee
- No non-managerial input
Operation
Establish processes for elimination of hazards and reduction of OH&S risks using hierarchy of controls.
- Hierarchy of controls applied per hazard
- Engineering control register
- Design reviews
- PPE as primary control
- No design out
Establish process for implementation and control of planned temporary or permanent changes that impact OH&S performance.
- MOC procedure
- Pre-startup safety review
- Change register
- Temp changes bypass MOC
- No HAZOP on changes
Coordinate procurement processes including contractors and outsourced functions to ensure conformity with OH&S MS requirements.
- Contractor prequalification
- Site induction records
- Contractor performance reviews
- No prequalification
- Lowest cost wins
Establish, implement and maintain processes to prepare for and respond to potential emergency situations.
- Emergency response plan
- Drill records
- First aider register
- Evacuation diagrams
- Drills not tested
- No scenario variation
Performance evaluation
Determine what, methods, when and analyse OH&S performance and effectiveness of OH&S MS.
- KPI reports
- Leading indicators
- Calibration of monitoring equipment
- Lagging only
- No statistical analysis
Plan, establish, implement and maintain processes to evaluate fulfilment of legal and other requirements.
- Compliance evaluation reports
- Action items log
- Regulator correspondence
- Annual only
- No documented evaluation
Conduct internal audits at planned intervals to provide information on whether OH&S MS conforms and is effectively implemented.
- Audit programme
- Audit reports
- Auditor competence records
- Auditor independence weak
- Findings not closed
Top management reviews OH&S MS at planned intervals to ensure continuing suitability, adequacy and effectiveness.
- Management review minutes
- Input/output evidence
- Action register
- No worker input
- Skipped inputs
Planning
Establish ongoing proactive process for hazard identification considering routine and non-routine activities, human factors and emergency situations.
- Hazard register
- Job safety analyses
- Risk assessment matrix
- Human factors review
- Only physical hazards
- No psychosocial assessment
Determine and have access to up-to-date legal and other requirements applicable to OH&S hazards.
- Legal register
- Compliance evaluation
- Subscription to regulatory updates
- Outdated register
- No state/jurisdictional split
Plan actions to address risks, opportunities, legal requirements and emergency situations and integrate into OH&S MS processes.
- OH&S action plan
- Hierarchy of controls applied
- Integration evidence
- PPE-first thinking
- No elimination/substitution
Establish measurable OH&S objectives at relevant functions and levels consistent with policy.
- SMART OH&S objectives
- KPI dashboards
- Owner assignments
- Lagging only
- No leading indicators
Support
Determine necessary competence of workers affecting OH&S performance and ensure they are competent through education, training or experience.
- Training matrix
- Licences/tickets register
- Competency assessments
- Contractor competence not verified
- Refreshers overdue
Workers aware of OH&S policy, their contribution to OH&S MS, incidents and outcomes, hazards relevant to them and right to remove themselves from imminent danger.
- Induction records
- Toolbox talk logs
- Stop-work authority policy
- No stop-work rights communicated
Determine internal and external communications relevant to OH&S MS including what, when, with whom and how.
- Communication matrix
- Safety alerts
- Crisis comms plan
- No language accommodations
- Top-down only
Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does. See the ISO 45001 framework page.