Free Practice Questions for PECB ISO-45001-Lead-Auditor Exam

The two options that give the strongest cause for concern are E and F.

E. The oil on the floor might spread to other areas of the kitchen is a clear OH and S concern because the spilled oil already presents a slip hazard in the work area and could increase the risk further if it spreads. ISO 45001 requires the organization to eliminate hazards and reduce OH and S risks through operational control. A spreading oil spill shows inadequate control of a workplace hazard and poor housekeeping in an active kitchen environment.

F. Fire protection may be inadequate without adjacent safety equipment is also a strong concern. In a kitchen with hot oil, boiling water, and multiple ignition sources, the absence of visible fire extinguishers or fire blankets raises concern about the adequacy of emergency preparedness and operational control. ISO 45001 requires organizations to establish processes for emergency preparedness and response, including provision for relevant emergency equipment where needed.

Why the other options are weaker:

A is speculative and refers to the storeroom, even though the immediate issue is the unsafe condition in the kitchen.

B is an assumption about workload, not objective evidence of a system failure.

C may be true, but impurities in waste oil are not the key OH and S issue identified here.

D focuses on whether cleaning arrangements are documented, but ISO 45001 does not require every control to be a documented procedure; the stronger evidence is the unsafe condition itself.

The auditor should assess whether the organization ' s planned action (using masks in case of dust extraction failure) is both implemented and effective. This aligns with ISO 45001 requirements to ensure that control measures are functional and meet the intended objectives.

Clause 8.1.2 (Hierarchy of Controls):The use of PPE, such as masks, is considered a last resort in the hierarchy of controls. The organization must demonstrate that the measure is:

Implemented (e.g., PPE is available and workers are trained to use it).

Effective (e.g., masks provide adequate protection against dust).

Analysis of Options:

A. Advise that the factory should cease operations if the dust extraction equipment malfunctioned.While ceasing operations may be a necessary control in extreme situations, it is not a practical or realistic recommendation unless a high-risk scenario cannot be otherwise managed.

B. Ask the OHSMS Manager to confirm regulatory compliance.Regulatory compliance is important but does not fully address the requirement to ensure the action is effective.

C. Seek evidence that the response action is both implemented and effective.This is the most appropriate response. The auditor must verify implementation and effectiveness to determine conformity.

D. Suggest increasing maintenance checks.Maintenance is important for preventing equipment breakdowns, but this option does not address the immediate audit finding about the adequacy of response actions.

ISO References:

Clause 8.1.2: Emphasizes applying the hierarchy of controls effectively.

Clause 9.1.1: Requires monitoring and measuring controls to ensure effectiveness.

The best answer is B.

Under ISO 45001, worker consultation and participation is required by Clause 5.4, but the standard does not require a specific documented procedure for that clause. The organization must provide mechanisms, information, time, training, and resources for consultation and participation, but ISO 45001 does not say it must maintain a formal procedure specifically for this.

Also, ISO 45001 Clause 7.5.3 requires documented information to be controlled so that it is available and suitable for use, and adequately protected. An “obsolete” document is not automatically a nonconformity just because it exists. It may be retained for reference or historical reasons, provided the organization controls it properly and it is not being used unintentionally as current information. That is why the correct audit reaction is to note it and verify on site whether it is actually part of the current controlled documented information.

Why the other options are not the best:

A is weak because using an obsolete procedure to prepare the checklist risks relying on invalid information before confirming what the current controlled version is.

C is unnecessary as the first response. You already have enough evidence to note a potential document-control point and verify it during the audit.

D is incorrect because you should not raise a nonconformity before verifying the facts on site. An obsolete-marked document alone does not prove a breach of Clause 7.5.3. A nonconformity must be based on objective evidence gathered during the audit.

The correct responses are C and D.

Certification bodies are required to have documented procedures for determining audit time and to determine the time needed to plan and accomplish a complete and effective audit. Audit duration is not something that can simply be shortened because the client asks for less disruption. ISO/IEC 17021-1 requires the certification body to determine audit time through its documented process, and the justification for the duration must be recorded. (IAS)

IAF MD 5 also states that certification bodies shall identify the audit time for each client and that this framework is used within the certification body’s processes to determine the appropriate audit time, taking into account the specifics of the client organization. That means the request may be considered, but it does not have to be accepted. (IAF)

Therefore:

C. Advise that his request will be considered but may not be taken up is correct, because the certification body can review the request, but the final decision must still comply with its audit-time rules and adequacy requirements. (IAF)

D. Advise the OHS Manager that the audit duration and team make-up will be decided in line with the internal procedures of the certification body is correct, because ISO/IEC 17021-1 requires the certification body to use documented procedures for audit time and team decisions. (IAS)

Why the other options are incorrect:

A is inappropriate because the request is not automatically a reason to tell the client to choose another certification body.

B is incorrect because the request cannot simply be accepted without following the certification body’s rules. (IAS)

E is too absolute; the request should be considered against the certification body’s requirements, not rejected automatically. (IAF)

F is unnecessary because the people managing the audit programme already have the responsibility to handle such matters through the certification body’s procedures. (IAS)

An auditor must base findings on objective evidence and applicable criteria rather than personal opinion about whether a process appears dangerous. C correctly redirects the audit trail toward Clause 6.1.2 hazard identification and assessment of OH and S risks. H obtains relevant evidence from workers and tests consultation and participation as well as incident experience. B explores whether safer alternatives and the hierarchy of controls have been considered. F is important because conformity with Clause 8.1.1 cannot be rejected merely because the auditor dislikes the prescribed method; evidence must demonstrate that operational planning and control are inadequate or ineffective before a nonconformity can be justified. The auditor should not personally participate in the hazardous task, stop the process without appropriate authority, or raise a finding solely on subjective judgement. Auditors gather and evaluate evidence; management remains responsible for determining and implementing operational controls.

Activities following the closure of a third-party audit are generally related to improving the audit process and addressing any unresolved issues.

Analysis of Options:

A. Addressing any audit complaints:Correct. Post-audit, complaints or concerns from stakeholders are addressed to improve the audit process and maintain credibility.

B. Conducting a closing meeting:Incorrect. The closing meeting occurs before the audit is closed.

C. Conducting a review of opportunities for improvement:Correct. Reviewing opportunities for improvement post-audit helps in refining processes and aligning them with organizational goals.

D. Revising the audit ' s objectives:Incorrect. Audit objectives are established during the planning phase, not after the audit has been closed.

E. Updating risks and opportunities to the audit programme:Incorrect. Updates to risks and opportunities occur during ongoing audits, not specifically post-audit.

F. Writing the audit report:Incorrect. The audit report is prepared before the audit is officially closed.

ISO References:

Clause 9.2.2: Audit process review.

ISO 19011:2018, Clause 6.7: Managing complaints and follow-up.

Analysis of Options:

A. The organisation must attempt to identify and address every risk it faces:Incorrect. ISO 45001 focuses on OH and S risks and not every risk faced by the organization.

B. The effect of uncertainty (i.e. risk) can result in positive outcomes as well as negative ones:Correct. Clause 3.20 defines risk as the " effect of uncertainty, " which may result in positive or negative outcomes.

C. Although organisations are required to carry out risk management, the method by which they do so is up to them:Correct. ISO 45001 does not prescribe specific risk management methods, leaving the organization to choose the approach that best suits its context (Clause 6.1.2).

D. Risk assessment is an activity that must be carried out by top management:Incorrect. Risk assessment can involve workers and other personnel; it is not limited to top management.

E. The organisation is required to assess risks arising from OH and S hazards:Correct. Clause 6.1.2.2 requires organizations to assess OH and S risks associated with hazards.

F. Risk is often expressed as a combination of likelihood and impact:Correct. This is a common way to express risk, aligned with Clause 6.1.2.

ISO References:

Clause 3.20: Definition of risk.

Clause 6.1.2: Hazard identification and risk assessment

The PDCA cycle (Plan-Do-Check-Act) is a core framework in ISO 45001 for continual improvement of the OH and S management system. An Environmental Management Program is part of ISO 14001 (Environmental Management System) and not ISO 45001.

Analysis of Options:

A. Treatment of Risks:Correct. Risk treatment is part of the Plan phase.

B. OHSMS Policy:Correct. The policy is developed in the Plan phase.

C. Environment Management Program:Incorrect. This is outside the scope of ISO 45001 and relates to ISO 14001.

D. Analyzing OHSMS Performance:Correct. Performance analysis is part of the Check phase.

ISO References:

Clause 0.3: PDCA framework in ISO 45001.

ISO 45001:2018 Clause 9.3.3 states that the outputs of management review shall include decisions related to:

the continued suitability, adequacy and effectiveness of the OH and S management system,

opportunities for continual improvement,

any need for changes to the OH and S management system,

resources needed,

actions, if needed,

opportunities to improve integration of the OH and S management system with other business processes, and

any implications for the strategic direction of the organization.

Based on that, the six correct outputs are:

B. Procurement of new safety harnesses for workers

This is evidence of an action/resource decision arising from management review. It shows management has decided to provide resources or take action to improve OH and S performance.

D. Allocation of a bigger budget for the OHS department

This clearly matches resources needed, which is specifically listed as a management review output.

E. Plan to prioritise health and safety issues as a business strategy

This fits implications for the strategic direction of the organization, which ISO 45001 names as a management review output.

F. Decisions related to continual improvement opportunities

This is almost verbatim from Clause 9.3.3: management review outputs include decisions related to opportunities for continual improvement.

G. Improvements in the OHSMS

This reflects changes needed in the OH and S management system and resulting improvement actions. Where management review decisions lead to system improvements, those improvements are valid output evidence from the review.

J. Opportunities to integrate the OHS management system with other business processes

This is directly stated in Clause 9.3.3 as a required management review output.

Why the other four are not outputs:

A. Report showing the trend of an increase in safety incidents is an input to management review under performance information and trends, not an output.

C. Minutes of previous management reviews are also an input, because management review must consider the status of actions from previous reviews.

H. Worker feedback of positive and negative comments is an input, linked to consultation, participation, and relevant communications.

I. Updates to the risk register may result from actions elsewhere in the system, but they are not specifically identified in ISO 45001 as required management review outputs.

Therefore, the six statements that represent output audit evidence for management review are:

B, D, E, F, G, J