A first-party audit is an internal audit. In ISO management system auditing terminology, first-party audits are performed by, or on behalf of, the organization itself to evaluate its own management system. Therefore, E. Internal audit is directly correct.

A first-party audit can also be carried out as a process audit when the organization audits one of its own processes to determine whether it is planned, implemented, maintained, and effective. Since internal audits under ISO 45001 are planned and conducted over processes, functions, and areas within the OH and S management system, D. Process audit also applies.

Why the other options are not correct:

A. Certification audit is a third-party audit, carried out by a certification body, not a first-party audit.

B. Surveillance audit is also a third-party certification body activity conducted after certification.

C. Regulatory audit is performed by a regulator or authority, not by the organization on itself.

F. External audit does not describe a first-party audit, because first-party audits are internal by definition.

Therefore, the two phrases that apply to a first-party audit are:

D, E

Ethical – C

Diplomatic – F

Open to improvement – B

Perceptive – E

These behaviours are standard auditor personal attributes used in lead auditor training and are aligned with audit competence guidance.

Ethical – C. Fair, truthful, sincere, honest, discreet

An ethical auditor acts with integrity. This includes honesty, truthfulness, sincerity, fairness, and discretion when handling audit evidence, findings, and confidential information. Ethical behaviour is essential because audit conclusions must be trusted and based on professional conduct.

Diplomatic – F. Tactful in dealing with individuals

A diplomatic auditor interacts with people carefully and respectfully. During audits, questions may be sensitive, findings may be difficult to communicate, and interviewees may feel pressure. Being tactful helps maintain cooperation and supports effective evidence gathering.

Open to improvement – B. Willing to learn from situations

An auditor who is open to improvement learns from audit experience, changing conditions, and new information. This behaviour supports continual development and better audit effectiveness over time.

Perceptive – E. Aware of and able to understand situations

A perceptive auditor recognizes what is happening in the audit environment and understands the significance of what is seen, heard, and observed. This helps the auditor detect inconsistencies, identify risks, and understand process realities beyond prepared answers.

Why the other options are not used here:

A. Persistent and focused on objectives describes tenacious behaviour.

D. Actively observing surroundings/activities describes observant behaviour.

So the correct matching is:

Ethical – C

Diplomatic – F

Open to improvement – B

Perceptive – E

ISO 45001 requires the organization to adapt the work to workers as part of operational planning and control. Clause 8.1.1(d) states that the organization shall plan, implement, control and maintain the necessary processes, including adapting the work to workers. Annex A.8.1.1 then gives examples, including: redefining how work is organized, redefining processes and work environments, and using ergonomic approaches in the design or modification of workplaces and equipment.

Based on that, D. Providing those who spend the majority of their working days on their computers with frequent breaks is a valid example because it adapts the organization of work to human needs and helps reduce strain and fatigue. This matches the Annex guidance about redefining how work is organized and using ergonomic approaches.

F. Amending a control station to facilitate handicapped workers is also a clear example. ISO 45001 specifically refers to using ergonomic approaches in the design of new workplaces/equipment or in modifying workplaces/equipment. Changing a control station to suit disabled workers is exactly the kind of ergonomic and workplace adaptation the standard is referring to.

G. Amending the start and finish times of processes to accommodate cultural practices is the third valid example, because Annex A.8.1.1 includes the definition or redefinition of how work is organized. Adjusting working times to suit workers’ needs is a direct way of adapting work organization to workers.

Why the others are not the best examples:

A is about competence, which relates more to Clause 7.2 Competence, not adapting work to workers.

B is not appropriate because if workers speak different languages and there are no subtitles, the communication is not being made understandable; ISO 45001 expects information to be comprehensible and identifies language barriers as participation barriers.

C relates to worker participation and consultation, not adapting work to workers.

E is good housekeeping/welfare, but not specifically an example of adapting work to workers in the sense used by ISO 45001 Annex A.8.1.1.

H relates to planning under Clause 6.1, not adapting work to workers.

Therefore, the three actual examples of adapting work to workers are:

D, F, G

Clause 9.3 of ISO 45001:2018 outlines the requirements for management reviews. These reviews must evaluate the performance of the OHSMS and identify opportunities for improvement. Outputs of management reviews typically include decisions and actions that align with strategic and operational priorities.

Analysis of Options:

A. Decisions related to continual improvement opportunities:This is a valid output, as continual improvement is a key objective of management reviews under Clause 10.3.

B. Allocation of a bigger budget for the OHS department:Resource allocation is a common output of management reviews to address identified needs.

C. Improvements in the OHSMS:Improvements reflect the organization’s commitment to enhancing safety performance.

D. Minutes of previous management reviews:While minutes provide context, they are not an output of the current management review.

E. Opportunities to integrate the OHS management system with other business processes:Integration opportunities are valid outputs, as they enhance the system ' s effectiveness.

F. Plan to prioritize health and safety issues as a business strategy:Strategic alignment of health and safety with business objectives is an expected output.

G. Procurement of new safety harnesses for workers:This is an operational action, not a direct output of the management review process.

H. Report showing the trend of an increase in safety incidents:This is an input to the management review, not an output.

I. Updates to the risk register:Risk register updates reflect changes in identified hazards and risks, making this a valid output.

J. Worker feedback of positive and negative comments:Worker feedback is an input to the management review, not an output.

ISO References:

Clause 9.3: Management review inputs and outputs.

Clause 10.3: Continual improvement actions.

The correct answers are B, E, and G.

G is true because ISO 19011 states that a closing meeting should be held to present the audit findings and conclusions. This applies to audits generally, not only third-party audits. (Oshisis)

E is true because ISO 19011 guidance says that for some audit situations the closing meeting may be formal, but in other instances, such as internal audits, the closing meeting can be less formal and may simply consist of communicating the findings and conclusions. That means a first-party closing meeting is commonly less formal than a third-party certification closing meeting. (Synersia Foundation)

B is also true. ISO 19011 and related guidance allow the use of remote methods / ICT in audit activities, and remote audit methods may be combined with on-site methods. From that, it follows that the audit team leader may arrange for audit team members to join activities such as the closing meeting virtually, where appropriate and controlled. This is an inference from the permitted use of ICT in audits. (ISO)

Why the others are false:

A is false because the closing meeting is for presenting findings and conclusions, not for changing findings simply because the auditee is unhappy. Findings can be clarified, but not changed without objective evidence. (Oshisis)

C is false because there is no rule that the audit team must meet formally immediately after the closing meeting to consider recommendations.

D is false because ISO 19011 says some closing meetings may be formal and recorded, but internal audits can be less formal, so they do not always have to be documented in that way. (Synersia Foundation)

F is false because the audit team leader is responsible for managing the audit team and assigning roles.

H is false because the closing meeting should be chaired by the audit team leader, not by the audit client. (Oshisis)

In a first-party audit (internal audit), the organization conducts the audit to determine whether its management system conforms to planned arrangements, to the organization’s own requirements, and to the requirements of ISO 45001, and whether it is effectively implemented and maintained. ISO 45001 Clause 9.2 requires internal audits to provide information on conformity and effectiveness.

E. Verify compliance with regulatory requirements is a valid audit objective because ISO 45001 requires the organization to determine its legal and other requirements and to evaluate compliance with them. Internal audits commonly include verification that these legal OH and S obligations are being met as part of checking the effectiveness and conformity of the OH and S management system. This aligns with Clause 6.1.3 and Clause 9.1.2 of ISO 45001.

B. Complete the audit on time is also an audit objective in practical first-party auditing because audit objectives are established for the audit and supported by planning, resources, timing, and reporting arrangements. While it is not a system conformance criterion, it is a valid objective for the audit assignment itself, ensuring the audit is performed as planned and efficiently managed. This fits normal lead auditor practice in planning and conducting internal audits.

Why the other options are not correct:

A. Apply international standards is too broad and is not itself an audit objective. Standards are the criteria or reference, not the objective.

C. Confirm the scope of the management system is accurate is not usually stated as a first-party audit objective; scope is established by the organization under Clause 4.3, though it may be reviewed during audits.

D. Prepare the audit report for the certification body does not apply to a first-party audit, because internal audits are not performed for a certification body.

F. Update the management policy is a management responsibility, not an audit objective. Audits may identify inputs for policy review, but updating the policy is not the purpose of the audit itself.

Therefore, the two correct options are:

B, E

ISO 45001 requires an organization to determine the external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended results of the OH and S management system. This is established in Clause 4.1 – Understanding the organization and its context. External issues are typically conditions arising outside the organization, such as market conditions, social conditions, legal environment, economic factors, and technological developments. Internal issues are those related to the organization’s people, structure, culture, ownership, competence, and operational arrangements.

D. New technology available on the market is an external issue because it exists in the external business and technological environment. It is not created inside the organization, but it can affect how the organization manages OH and S risks and opportunities, for example by introducing safer equipment, automation, or new control methods. ISO 45001 guidance in Annex A recognizes that technological environment can be part of context analysis.

F. Average salaries in the business sector is also an external issue because it relates to the wider economic and labor-market environment, not the organization’s own internal arrangements. This kind of issue can influence recruitment, retention, competence availability, and worker welfare conditions, all of which may indirectly affect OH and S performance. It is part of the external economic context.

Why the other options are not external:

A. Increased number of outsourced processes is mainly an internal organizational decision about how work is arranged and controlled. Although outsourced providers are external parties, the increase in outsourcing is part of the organization’s internal operating model.

B. New owners of the organisation is an internal issue because ownership and governance are part of the organization’s internal structure and direction.

C. Workers joined a trade union is generally treated as an internal workforce/industrial relations issue, because it directly concerns the organization’s workers and participation arrangements.

E. Recently hired workers with limited command of the local language is an internal issue because it concerns the competence, communication, and workforce characteristics within the organization.

Therefore, the two options related to external issues are:

D, F

ISO 45001 requires organizations to identify and maintain documentation to demonstrate compliance with legal and other requirements (Clause 7.5 and Clause 9.1.2). It also requires the evaluation and control of outsourced processes (Clause 8.1.4.3).

Analysis of Options:

A. The park did not have the required documentation to demonstrate compliance with legal requirements:Correct. The outdated and incomplete inspection report (8 years old, lacking detailed identification) fails to demonstrate compliance with health and safety legislation.

B. The organization did not monitor the safety checks by staff of equipment:Incorrect. While there is a potential gap in monitoring, the evidence provided does not directly indicate a lack of monitoring of staff checks.

C. The inspection organization employed by the insurance organization was not evaluated:Correct. ISO 45001 requires the organization to evaluate outsourced services, including those provided by the inspection body, to ensure their adequacy.

D. The park relied on the insurance organization to evaluate its OHS risks:Incorrect. Reliance on external evaluations may not constitute a nonconformity if risks are properly managed, but there is no evidence provided for noncompliance here.

E. Testing to determine the safe loading of equipment was not carried out:Incorrect. While load testing is crucial, there is no evidence presented to confirm this specific issue as a nonconformity.

ISO References:

Clause 7.5: Control of documented information.

Clause 8.1.4.3: Control of outsourced processes.

Clause 9.1.2: Evaluation of compliance.

Clause 10.2 requires organizations to investigate nonconformities, determine their causes, and take corrective actions to prevent recurrence. Clause 9.2.2 specifies the requirements for managing internal audit processes, while Clause 7.4.3 emphasizes the need to communicate relevant information effectively.

Analysis of Options:

A. 9.2.2.e - Management failed to take any action to deal with the audit nonconformity:Correct. Management must ensure that internal audit findings are addressed promptly. The lack of action violates Clause 9.2.2.e.

B. 9.2.2.d - Staff were not made aware that health and safety incidents were increasing:Incorrect. This clause pertains to the planning and conduct of audits, not the communication of findings.

C. 8.1.1 - Operations were not properly controlled to avoid health and safety incidents:Incorrect. While increased incidents may suggest operational issues, this option does not directly relate to the internal audit findings.

D. 9.2.2 - Report IA202 contained a poorly worded nonconformity (NC3):Incorrect. The clarity of the nonconformity wording is not directly relevant to Clause 9.2.2.

E. 10.2.b - The root cause of the increase in reported health and safety accidents was not investigated:Correct. Failure to investigate root causes violates Clause 10.2.b.

F. 7.4.3 - The results of the internal audit IA202 were not communicated to interested parties:Correct. Effective communication of audit results is required under Clause 7.4.3.

ISO References:

Clause 9.2.2: Internal audit process requirements.

Clause 10.2: Nonconformity and corrective action.

Clause 7.4.3: Communication requirements.

Clause 0.2 of ISO 45001 emphasizes the involvement of top management and alignment of OH and S objectives with the organization’s OH and S policy.

Nonconformities Identified:

The objectives were developed by an external consultant without involving top management, which undermines leadership accountability and commitment.

The objectives were based on a competitor’s framework, not aligned with the organization’s unique OH and S policy or context.

Analysis of Options:

A. Establishing OH and S objectives did not include top management.True. Clause 5.1 (Leadership) and Clause 6.2 (Objectives) emphasize that top management must be involved in defining and supporting OH and S objectives.

B. OH and S objectives are not being implemented by personnel.Implementation relates to operationalization, not the development phase, and is not relevant to Clause 0.2.

C. OH and S objectives are not maintained as documented information.While documentation is required, the absence of documented information is a separate issue under Clause 7.5, not Clause 0.2.

D. OH and S objectives were not established in alignment with the organization’s OH and S policy.True. Clause 6.2.1 requires objectives to align with the OH and S policy, which reflects the organization’s commitment to safety and health.

E. The consultant has not interpreted ISO 45001 correctly.While possibly true, the issue here is the organization’s failure to involve top management, not the consultant’s interpretation.

F. The organization cannot afford to undertake OH and S objectives all at once.Financial constraints are not relevant to Clause 0.2; objectives can be prioritized for phased implementation.

ISO References:

Clause 0.2: Leadership commitment and alignment with organizational policy.

Clause 5.1: Top management’s role in leadership and participation.

Clause 6.2.1: Establishing OH and S objectives aligned with the policy.

The three correct responses are A, B, and G.

A is correct because ISO 45001 Clause 5.3 requires top management to ensure that the responsibilities and authorities for relevant roles are assigned, communicated and understood at all levels within the organization, and that they are maintained as documented information. So if top management asks whether responsibilities and authorities for relevant roles have to be documented, the correct answer is yes.

B is correct because Clause 5.1 Leadership and commitment requires top management to ensure that the resources needed to establish, implement, maintain and improve the OH and S management system are available. Therefore, the auditor’s “Yes, you do” is correct.

G is correct because Clause 5.1 also requires top management to promote continual improvement. This is stated directly as part of top management leadership and commitment responsibilities under ISO 45001.

Why the others are not correct:

C is incorrect because top management does have to ensure that processes are established for consultation and participation of workers. Clause 5.4 makes this a requirement, so “No, you do not” is wrong.

D is incorrect as written. Top management must establish, implement and maintain the OH and S policy, but ISO 45001 does not state that top management personally has to “write” it. The wording in the option is too specific and not how the standard states the requirement.

E is incorrect because top management does have to ensure that the OH and S management system achieves its intended results. Clause 5.1 says this directly.

F is incorrect because top management must ensure OH and S objectives are established and compatible with the strategic direction, but ISO 45001 does not require top management personally to “write” the objectives.

H is incorrect because the organization must determine the scope under Clause 4.3, and top management remains accountable for the OH and S management system. Saying “No, you do not” is not correct in this context.

Explanation

Documented information on the organization’s legal requirements → Clause 6.1.3:Clause 6.1.3 requires the organization to identify, document, and maintain compliance obligations, including legal and other requirements relevant to OH and S.

Assessment of OH and S risks → Clause 6.1.2.2:Clause 6.1.2.2 mandates the organization to assess OH and S risks associated with its operations, taking into account hazards, controls, and work activities.

Internal and external issue determination → Clause 4.1:Clause 4.1 requires organizations to determine internal and external issues that affect the OH and S management system and its intended outcomes.

Agreements with the organization’s external providers → Clause 8.1.4.2:Clause 8.1.4.2 pertains to controlling external providers and ensuring their processes align with OH and S requirements, including documented agreements.

References

Clause 4.1: Understanding the organization and its context.

Clause 6.1.2.2: Assessment of risks and opportunities related to OH and S.

Clause 6.1.3: Compliance obligations.

Clause 8.1.4.2: Control of external providers.

Analysis of Options:

A. The organisation must attempt to identify and address every risk it faces:Incorrect. ISO 45001 focuses on OH and S risks and not every risk faced by the organization.

B. The effect of uncertainty (i.e. risk) can result in positive outcomes as well as negative ones:Correct. Clause 3.20 defines risk as the " effect of uncertainty, " which may result in positive or negative outcomes.

C. Although organisations are required to carry out risk management, the method by which they do so is up to them:Correct. ISO 45001 does not prescribe specific risk management methods, leaving the organization to choose the approach that best suits its context (Clause 6.1.2).

D. Risk assessment is an activity that must be carried out by top management:Incorrect. Risk assessment can involve workers and other personnel; it is not limited to top management.

E. The organisation is required to assess risks arising from OH and S hazards:Correct. Clause 6.1.2.2 requires organizations to assess OH and S risks associated with hazards.

F. Risk is often expressed as a combination of likelihood and impact:Correct. This is a common way to express risk, aligned with Clause 6.1.2.

ISO References:

Clause 3.20: Definition of risk.

Clause 6.1.2: Hazard identification and risk assessment

Activities following the closure of a third-party audit are generally related to improving the audit process and addressing any unresolved issues.

Analysis of Options:

A. Addressing any audit complaints:Correct. Post-audit, complaints or concerns from stakeholders are addressed to improve the audit process and maintain credibility.

B. Conducting a closing meeting:Incorrect. The closing meeting occurs before the audit is closed.

C. Conducting a review of opportunities for improvement:Correct. Reviewing opportunities for improvement post-audit helps in refining processes and aligning them with organizational goals.

D. Revising the audit ' s objectives:Incorrect. Audit objectives are established during the planning phase, not after the audit has been closed.

E. Updating risks and opportunities to the audit programme:Incorrect. Updates to risks and opportunities occur during ongoing audits, not specifically post-audit.

F. Writing the audit report:Incorrect. The audit report is prepared before the audit is officially closed.

ISO References:

Clause 9.2.2: Audit process review.

ISO 19011:2018, Clause 6.7: Managing complaints and follow-up.

Clause 9.1.2 of ISO 45001:2018 outlines the need for organizations to evaluate compliance with applicable legal and other requirements as part of their OH and S management system.

Analysis of Options:

A. The organization must evaluate its compliance status at least once a year:The standard does not prescribe a specific frequency but states that evaluations must be conducted at planned intervals.

B. ' Other requirements ' include requirements that the organization has chosen to comply with:Correct. Other requirements may include voluntary standards, industry codes, or contractual obligations.

C. A management review is required in all instances where one or more legal requirements are not being met:This is not true. Management reviews address compliance but are not mandated for every noncompliance.

D. Every member of an audit team must have a detailed understanding of the legal requirements for the sector and type of organization they are auditing:Not true. Auditors must have general competency but can rely on subject-matter experts for legal specifics.

E. If the organization is failing to address a legal requirement relating to another discipline (e.g., Environmental management), this cannot be raised in the audit:Not true. If the legal noncompliance impacts OH and S, it can be raised.

F. The organization cannot outsource its process for evaluating compliance:The organization can outsource evaluation but retains accountability.

G. The organization is required to establish a process for evaluating compliance:Correct. Clause 9.1.2 requires a process for compliance evaluation.

H. The organization is required to evaluate its compliance status with OH and S legal and other requirements:Correct. Clause 9.1.2 explicitly states this requirement.

ISO References:

Clause 9.1.2: Evaluation of compliance.

Clause 7.5: Documented information requirements

These four actions develop meaningful audit trails from the evidence already obtained. Reviewing safety-awareness training tests whether the organisation ' s claimed control is competently implemented. Comparing incident data with shopper numbers provides a meaningful performance measure rather than relying on raw incident totals, consistent with Clause 9.1.1. Reviewing hazard identification specifically for escalators evaluates conformity with Clause 6.1.2, because recurring escalator incidents indicate a hazard requiring systematic consideration. Finally, checking incident investigations tests Clause 10.2 requirements to react to incidents, determine causes and identify corrective actions necessary to prevent recurrence. A zero-incident policy is not an ISO 45001 requirement, retail tenants do not have to be independently certified, and questioning top management ' s knowledge of the standard would not directly investigate the observed incident trend. The Centre Manager ' s qualifications are similarly secondary to evaluating actual system effectiveness.

Corrections address immediate issues, such as errors or omissions, without addressing root causes. Clause 10.2 of ISO 45001:2018 allows for corrections alongside corrective actions.

Analysis of Options:

A. Adding a missing signature to a corrective action record:Correct. This is a correction addressing an administrative oversight.

B. Changing a process to reduce its inherent risk:Incorrect. This is a corrective action aimed at addressing root causes, not a correction.

C. Changing the name of a tutor that did not deliver a course to the name of the tutor that did:Correct. This corrects an error in records without addressing systemic issues.

D. Reviewing workers’ training records:Incorrect. This is part of ongoing monitoring or auditing, not a correction.

E. Updating the emergency preparedness plan as a result of carrying out a practical test:Incorrect. This is a corrective action resulting from performance evaluation, not a correction.

F. Using OHSMS induction training to address an identified lack of OHSMS awareness among workers:Incorrect. This is a preventive or corrective action, not a correction.

ISO References:

Clause 10.2: Nonconformity and corrective action.

Clause 7.5: Control of documented information

ISO 45001 Clause 7.2 Competence requires the organization to:

determine the necessary competence of workers that affect or can affect OH and S performance;

ensure workers are competent, including the ability to identify hazards;

where applicable, take actions to acquire and maintain competence and evaluate the effectiveness of those actions; and

retain appropriate documented information as evidence of competence.

Based on that wording, C is clearly correct because the clause explicitly says workers must be competent, including having the ability to identify hazards. If there is no evidence of that ability, this directly supports a nonconformity against Clause 7.2.

F is also correct because Clause 7.2 requires the organization to determine the competence needed for roles and ensure workers meet it. If there is no evidence that workers’ knowledge and skills are assessed against role requirements, the organization cannot demonstrate that competence has been determined and verified.

H is the third correct answer because Clause 7.2 requires the organization to retain documented information as evidence of competence. Attendance on OH and S training is not, by itself, full proof of competence, but the absence of training records can still support a finding that the organization lacks documented evidence related to competence development and maintenance.

Why the others are not Clause 7.2 findings:

A belongs to Clause 7.3 Awareness, which requires awareness of the consequences of not conforming.

B also relates more to Clause 7.3 Awareness, which includes awareness of the ability to remove themselves from imminent and serious danger.

D is also Clause 7.3 Awareness, because workers must understand their contribution to the effectiveness of the OHSMS.

E relates to consultation and participation under Clause 5.4, not competence.

G refers to quality policy and objectives, which are not ISO 45001 OH and S competence requirements.

Analysis of Each Option: