Title: ISO 45001 internal audit UK: OH&S management system > Outsourced ISO 45001:2018 internal audit for UK organisations: hazards, controls, worker consultation and legal compliance, audited on site. Fixed fee plus VAT. Source: https://aegentra.co.uk/services/govern/iso-45001-internal-audit Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-26 Licence: public web content; cite the source URL. Internal audit / United Kingdom # ISO 45001 internal audit A Clause 9.2 audit of your occupational health and safety management system that tests how hazards are identified, how controls are chosen and applied where work happens, whether workers are genuinely consulted, and whether legal requirements and incidents are handled as the system says. Independent of the people who built the system, judged on observation and records, priced as one fixed sum once scoped. Page reviewed 26 October 2026. UK fees quoted in GBP, VAT added at the prevailing rate. [Talk through your sites](https://aegentra.co.uk/contact?subject=ISO%2045001%20internal%20audit) [Follow a worked task](https://aegentra.co.uk/services/govern/iso-45001-internal-audit#working-example) Do the controls reflect how work actually happens? Scope and fee ## Priced by activity, site and risk. The fee follows the work activities and locations in scope, the hazard profile, and how much must be observed in person rather than read. One fixed sum, agreed in writing once the scope is known, in GBP with VAT added. ### What shapes an ISO 45001 audit fee - Work activities and their hazard profile: office, warehouse, workshop, field or construction - Sites, shifts and contractor interfaces that have to be observed rather than read about - Legal and other requirements register: how many duties apply and how compliance is evaluated - Incident, near-miss and consultation records available for sampling, and any previous enforcement contact [Request a scoped ISO 45001 audit proposal](https://aegentra.co.uk/contact?subject=ISO%2045001%20internal%20audit) The requirement in context ## ISO 45001 is audited where the work is done. ISO 45001:2018 asks an organisation to identify hazards, assess OH&S risks, apply the hierarchy of controls, consult and involve workers, evaluate compliance with legal requirements and learn from incidents. None of that can be audited from a policy folder. A useful internal audit stands where the work happens and compares what it sees with what the system says. Under Clause 9.2 the internal audit has to show two things: that the OH&S management system meets both ISO 45001 and the organisation’s own rules, and that it works in practice and keeps working. Effectiveness in a safety system shows up in whether risk assessments match the task being done, whether controls are in use, whether workers were consulted on changes that affect them, whether legal duties are evaluated rather than assumed, and whether incident investigations reach a cause. In the United Kingdom the management system sits on top of statutory duties under the Health and Safety at Work etc. Act 1974 and the regulations made under it. The internal audit is not a legal compliance opinion and does not replace a competent person’s advice under the Management Regulations, but it does test whether the organisation’s compliance-evaluation process exists and works. UKAS-accredited certification bodies expect the programme to cover every clause and every site in scope across the three-year cycle. Standards and law referenced [ISO: ISO 45001:2018 Occupational health and safety management systems](https://www.iso.org/standard/63787.html) [HSE: Health and Safety at Work etc. Act 1974](https://www.hse.gov.uk/legislation/hswa.htm) [UKAS: check a certification body’s accreditation](https://www.ukas.com/find-an-organisation/) On the ground ## Follow one task from hazard to lesson learned. An invented UK logistics operator with a warehouse, a yard and a delivery fleet. Your own criteria, evidence, sites and schedule are set in the proposal. | System element | Audit question (criterion) | Evidence sampled and observed | What the sample showed | | --- | --- | --- | --- | | Hazard identification (6.1.2.1) | Does the risk assessment for yard vehicle movements cover pedestrians, reversing and night operations? | The yard risk assessment, the traffic management plan and a 20-minute observation of a shift change. | Reversing and segregation covered; night lighting and agency drivers not considered; two pedestrians crossed the vehicle route during observation. | | Hierarchy of controls (8.1.2) | Were elimination and engineering controls considered before relying on high-visibility clothing and rules? | Control selection rationale in the assessment; site layout; barrier and signage records. | A one-way system had been proposed and not implemented; the assessment relied on PPE and a toolbox talk. | | Consultation and participation (5.4) | Were yard workers and agency staff consulted on the traffic plan and the shift-change arrangements? | Safety committee minutes, toolbox-talk attendance, interviews with three yard operatives and one agency driver. | Committee had discussed it twice; agency drivers were not represented and had not seen the plan. | | Compliance evaluation (9.1.2) | Has compliance with workplace transport duties been evaluated and recorded? | Legal register entry, evaluation record and the evaluator’s competence. | Register listed the duty; last evaluation was two years old and pre-dated the yard extension. | | Incident investigation (10.2) | Did the investigation of last quarter’s near miss reach a cause and change a control? | Near-miss report, investigation record, actions and the follow-up evidence. | Investigation recorded “driver error”; no change to segregation; a similar near miss followed six weeks later. | An invented scenario for learning. It is not a client outcome, a legal finding or a full audit programme. [Get this worked task as a spreadsheet (CSV)](https://aegentra.co.uk/downloads/govern-iso-45001-internal-audit-working-example.csv) What the audit leaves behind ## Observation. Consultation. A report management can act on. The output is a report that compares the OH&S management system with the work as it is actually done on sampled activities, written for top management and for the certification body, and usable in your consultation with workers. - Agreed audit criteria: ISO 45001:2018 clauses, your OH&S procedures, and the legal and other requirements in scope - Observation of sampled activities and sites, with worker and contractor interviews alongside the records - Tests of hazard identification, risk assessment currency, the hierarchy of controls, permits, emergency preparedness and contractor control - Review of consultation and participation, competence, compliance evaluation and incident investigation on sampled cases - Each finding graded against its clause and the activity observed, the exposure stated plainly, and an action log for top management ### What this audit is not It is not a statutory inspection, a legal-compliance opinion, a fire risk assessment or a guarantee of workplace safety. Specialist assessments such as noise, COSHH or DSE are separate competences. Only a UKAS-accredited certification body can award a certificate. If Aegentra built or advised on your OH&S system, a different auditor is assigned after a recorded impartiality check, or we decline the audit. How the audit runs ## Plan safely. Observe. Report plainly. Three stages, each leaving a record in your system. On-site time is planned around your shifts and site rules, and is agreed in the proposal. - ### Plan around the hazards Confirm the OH&S scope, the activities and locations, the legal register and the worker representation arrangements. Agree which activities will be observed, which incidents and consultations will be sampled, and the auditor’s own site induction, PPE and access. - ### Observe and interview Watch sampled tasks being done, compare them with the risk assessment and the controls it specifies, and talk to the workers and supervisors doing them, including contractors and agency staff. Then test the records: training, permits, inspections, maintenance, consultation and incidents. - ### Report the exposure Grade each finding against its criterion with the exposure stated plainly, raise anything serious on the day rather than in the report, confirm the facts with the people responsible, and report by activity with corrective action owners named for management review and worker consultation. A practical starting point ## Start from a near miss, a new site or a contractor. The best place to begin an ISO 45001 internal audit is where the system had to respond: a near miss, a change of site or process, or work handed to a contractor. Each exercises hazard identification, control selection, consultation, competence and investigation in one trail, and shows whether the system follows the work or only describes it. Fictional working exampleA facilities contractor takes on roof-gutter cleaning at a client’s site. The audit traces the task: the generic work-at-height assessment did not mention fragile roof lights, the operative had a harness but no anchor point had been identified, the client’s permit was signed without the method statement attached, and the operative had not been asked about the task because consultation ran through a committee he had never attended. One trail produces findings under 6.1.2.1, 8.1.2, 8.1.4.2 and 5.4, and a corrective action on the task-planning process rather than on one job. Aegentra is Australian-headquartered. UK ISO 45001 audits combine remote record review with on-site observation planned around your shifts and site rules; fees are quoted in pounds sterling plus VAT. Before the auditor arrives on site ## Safety questions. Straight answers. **What does an ISO 45001 internal audit cover?** Clauses 4 to 10 of ISO 45001:2018 in full over the certification cycle, examined through your activities and sites: context and worker needs, leadership and worker participation, hazard identification and risk and opportunity assessment, legal and other requirements, objectives, resources and competence, awareness and communication, operational controls including the hierarchy of controls, management of change, procurement and contractors, emergency preparedness, monitoring and compliance evaluation, internal audit and management review, incident investigation and improvement. **Is this a workplace inspection?** No. An inspection checks conditions on a day; this is a management-system audit that tests whether your processes for identifying hazards, controlling risk, consulting workers, evaluating compliance and learning from incidents exist and work. Observation of work is part of the method, but the conclusion is about the system. **Does the audit tell us whether we comply with health and safety law?** It tests whether your compliance-evaluation process under Clause 9.1.2 exists, is current and is carried out by competent people, and it will raise anything obviously unsafe on the day. It is not a legal opinion and does not replace competent health and safety advice under the Management of Health and Safety at Work Regulations. **How much does an ISO 45001 internal audit cost in the UK?** One fixed sum is agreed in writing once the scope is known, in GBP with VAT added. It reflects the activities and their hazard profile, the number of sites and shifts to observe, the size of the legal register and the incident and consultation records available for sampling. Send us your OH&S scope and site list for a like-for-like quote. **How much of the audit is on site?** More than for most management systems. Records, legal register and interviews with management can be reviewed remotely; hazard identification, control application, permits, emergency arrangements and worker consultation have to be observed where the work is done. The proposal states the on-site days and how they fit your shifts. **Do you talk to workers directly?** Yes, and to contractors and agency staff where they are in scope. Clause 5.4 requires consultation and participation of workers, and the only way to audit it is to ask the people doing the work whether they were consulted, whether they know the controls and whether they can raise concerns. Interviews are confidential and reported without attribution. **What if you see something dangerous during the audit?** We stop and raise it with the supervisor immediately, before anything else, and record it as audit evidence afterwards. The audit does not wait for a closing meeting when there is an immediate risk to a person. **How should we prepare?** Have the OH&S scope, site and activity list, hazard identification and risk assessments, the legal and other requirements register with evaluation records, the consultation arrangements and minutes, training and competence records, permits and inspection records, the incident and near-miss log with investigations, earlier audit reports and management-review minutes to hand, and arrange site access, induction and PPE for the auditor. Do not send personal medical information through the enquiry form. Where to go next ## Related work. Separate responsibilities. Book a safety system audit, run it alongside a quality or security audit, or work out what a client or principal contractor has actually asked for. ### Related services [Internal audit across five standards](https://aegentra.co.uk/services/internal-audit) [ISO 9001 internal audit](https://aegentra.co.uk/services/govern/iso-9001-internal-audit) [ISO 27001 internal audit](https://aegentra.co.uk/services/govern/iso-27001-internal-audit) ### Clarify your requirement [A course, an audit or implementation support?](https://aegentra.co.uk/knowledge/course-or-consultancy) [Check a certificate and what it covers](https://aegentra.co.uk/knowledge/checking-certification) ## Let’s look at the work, not the folder. Tell us what your people do, where they do it, how many sites you run and the date your certification body has set. [Start the conversation](https://aegentra.co.uk/contact?subject=ISO%2045001%20internal%20audit)