ISO Audit Checklist: 13 Proven Steps to Prepare (2026)

The audit plan from your registrar just landed in your inbox. The dates are fixed, an auditor is booked, and every promise your safety management system makes is about to be checked against real records and real conversations on the floor. A clear ISO audit checklist turns that deadline from a scramble into a schedule.

This guide gives you 13 preparation steps on a 12-week timeline, the evidence auditors ask for clause by clause under ISO 45001, how to get workers ready for interviews, and exactly what to do if the closing meeting brings a major nonconformity.

What an ISO Certification Audit Actually Checks

An ISO certification audit is run by a certification body, often called a registrar, not by ISO itself. In the United States, the ANSI National Accreditation Board (ANAB) accredits registrars for ISO 45001 and keeps a public directory, so you can confirm your auditor's accreditation on the ANAB ISO 45001 program page before audit day.

Whatever the standard, the auditor is testing four things:

• Design: your system covers every requirement of the standard
• Practice: people do what your procedures say they do
• Proof: objective evidence, such as records, shows it happened, not just that it was planned
• Improvement: the system finds its own problems and fixes them

Stage 1 vs Stage 2 in One Paragraph

For a first certification, the audit runs in two parts. Stage 1 is a readiness check focused on your documented system, scope, and planning. Stage 2 is the full on-site audit, where the auditor interviews workers, walks the site, and samples records to see whether the system works in practice. If you want the full breakdown of audit types, our guide to internal vs external audits covers it in detail.

Surveillance and Recertification Audits

Certification is not a one-time event. A typical cycle is the initial two-stage audit, surveillance audits in years one and two, and a full recertification audit in year three. The checklist below works for all of them. The main difference is that surveillance auditors usually start by checking whether you closed the findings from the last report.

How to Prepare for an ISO Audit: 13-Step Checklist

To prepare for an ISO audit, confirm scope and dates with your registrar, close findings from the last report, run an impartial internal audit, close corrective actions with proof, hold a minuted management review, brief your workers, and run a mock audit two weeks out.

Here is the full ISO audit checklist in order:

1. 1. Confirm scope, sites, shifts, and dates with your registrar.
2. 2. Read the audit plan and assign an owner to every process listed.
3. 3. Re-read your last audit report and verify every open item is closed.
4. 4. Update your register of legal and other requirements.
5. 5. Run a full internal audit with auditors who are independent of the area.
6. 6. Log every internal finding in your corrective action system.
7. 7. Close corrective actions with root cause and proof they worked.
8. 8. Hold and record a management review.
9. 9. Check that documented information is current, approved, and easy to find.
10. 10. Brief supervisors and workers on what auditors ask and why.
11. 11. Run a mock audit, including a floor walk and worker interviews.
12. 12. Prepare logistics: escorts, a meeting room, visitor PPE, and records access.
13. 13. Confirm who attends the opening and closing meetings.

The timeline below spreads these steps across 12 weeks. Treat it as an audit readiness model, not a rule. A small single-site company may compress it, while a multi-site firm going for its first certificate usually needs longer.

The 13-step ISO audit checklist mapped across a 12-week countdown.

12 Weeks Out: Lock Scope, Dates, and the Audit Plan (Steps 1 to 4)

Start with the registrar's audit plan. It lists which processes, sites, and shifts the auditor will cover, so it tells you where to spend your effort. If night shift or a satellite warehouse is in scope, plan for it now.

Then pull out the last audit report. Every minor nonconformity from the previous visit should already have a closed corrective action with evidence attached. An open item from last year is one of the fastest ways to turn a minor finding into a major one.

Finish this phase by refreshing your legal register. For a US site, that means checking the OSHA standards that apply to you, any state plan rules, and requirements from customers or contracts.

8 Weeks Out: Run a Full Internal Audit (Steps 5 and 6)

ISO 45001 clause 9.2 requires internal audits, and auditors will sample your audit program, not just the most recent report. Two details matter most:

• Impartiality: nobody should audit their own work. A maintenance supervisor can audit the warehouse, but not maintenance.
• Coverage: Every clause and every in-scope area should appear in your audit program across the cycle.

Write findings as facts tied to a requirement. "Forklift pre-use checks not recorded on 4 of 10 days sampled, clause 8.1" is useful. "Forklift checks need work" is not.

6 Weeks Out: Close Corrective Actions With Proof (Step 7)

Clause 10.2 asks for more than a quick fix. For each finding, your record should show:

1. 1. The immediate correction (what you did to contain the problem).
2. 2. The root cause, with workers involved in finding it.
3. 3. The corrective action that removes the cause.
4. 4. A check, after enough time has passed, that the action actually worked.

4 Weeks Out: Management Review and Document Control (Steps 8 and 9)

Clause 9.3 requires top management to review the system. Auditors look for minutes showing that leaders actually discussed audit results, incidents, objectives, and worker consultation, then made decisions. A signature on a slide deck is weak evidence. Recorded actions with owners and dates are strong evidence.

Use the same week to sweep your documented information. Look for out-of-date procedures, forms that no longer match the process, and uncontrolled printouts taped to walls. Anything a worker uses on the floor should match the current approved version.

2 Weeks Out: Brief People and Run a Mock Audit (Steps 10 and 11)

A mock audit is a dress rehearsal. Pick someone who did not build the system, give them the registrar's audit plan, and have them follow it: opening meeting, document sampling, floor walk, and interviews.

Two things to test:

• Retrieval speed: Can you find any training record or inspection log within a couple of minutes?
• Practice vs paper: does what workers describe match what the procedure says?

Audit Week: Logistics and People (Steps 12 and 13)

Book a quiet room with network access to your records. Assign escorts who know the site and can answer questions honestly. Have visitor PPE ready in the right sizes. Confirm that top management can attend the opening and closing meetings, because auditors often interview senior leaders on the policy and their commitment.

Documents and Records Required for an ISO Audit

Auditors need two kinds of evidence. Documents show what you plan to do, such as your policy and procedures. Records prove what you did, such as training logs and inspection results. The registrar's audit plan and the standard together set the exact list.

For an ISO 45001 audit, have these ready and easy to reach:

• Scope statement and organization chart
• OH&S policy, signed and communicated
• Hazard identification and risk assessment register
• Legal and other requirements register, plus your compliance evaluation
• OH&S objectives with targets, owners, and progress
• Competence and training records for roles that affect safety
• Worker consultation records, such as safety committee minutes
• Emergency drill records and post-drill reviews
• Incident investigations, including near misses
• Internal audit program and reports
• Management review minutes
• Corrective action log with effectiveness checks

If your safety program is still taking shape, our HSE management system guide explains how these pieces fit together.

ISO 45001 Audit Checklist: Clause-by-Clause Evidence Table

The table below turns the standard's clauses into the questions auditors tend to ask and the evidence that answers them. Use this ISO 45001 audit checklist for your own internal audit or as a mock audit script. For background on what each clause means, see ISO 45001 requirements explained.

Auditors sample records at random, so every clause needs evidence ready to show.

The 2024 Climate Change Amendment (Clauses 4.1 and 4.2)

In 2024, ISO amended its management system standards, including ISO 45001, to add climate change to the context clauses. Clause 4.1 now requires you to decide whether climate change is a relevant issue for your organization. Clause 4.2 gained a note that interested parties can have climate-related requirements.

Certification bodies applied the change with no transition period, so it is checked at your next audit. According to commentary from the Chartered Quality Institute and Intertek, the requirement is to consider climate change and record your decision, not to launch a climate program.

For a safety system, the link is practical. Heat stress, severe weather, and flooding can all affect hazards and emergency planning, so a recorded decision often flows into your risk register and emergency procedures.

Using ISO 9001 or ISO 14001? What Carries Over

ISO 9001, ISO 14001, and ISO 45001 share the same high-level structure, with clauses 4 through 10 in the same order. That means much of this checklist transfers: context, leadership, internal audit, management review, and corrective action work the same way. What changes is the operational content. Quality audits focus on product and customer requirements, while environmental audits focus on environmental aspects and compliance obligations.

How to Prepare Employees for Auditor Interviews

Interviews are where a paper system gets exposed. Auditors talk to workers on the floor because workers show whether the system is real. The goal of your briefing is honesty and confidence, not a script.

Give workers these ground rules:

• Describe your actual job, not what you think the auditor wants to hear
• Show the record if one exists, such as a checklist or permit
• Say "I'll find out" if you do not know, then point to who would
• Answer only the question asked, without guessing about other areas

Expect questions like these:

Worker interviews show the auditor whether the safety system works in practice.

What Happens on Audit Day: Opening Meeting to Closing Meeting

Most ISO audits follow the same sequence:

1. 1. Opening meeting. The auditor confirms scope, the plan, the schedule, and how findings will be reported.
2. 2. Document and record sampling. The auditor picks records at random, so everything needs to be in order, not just the examples you prefer.
3. 3. Floor walk. The auditor observes work, checks controls, and compares practice with procedures.
4. 4. Interviews. Workers, supervisors, and top management answer questions about their roles.
5. 5. Daily wrap-up. On multi-day audits, many auditors share emerging concerns at the end of each day.
6. 6. Closing meeting. The auditor presents findings, classifies any nonconformities, and explains the next steps.

Use the daily wrap-up well. If a concern rests on a missing record that actually exists, produce that objective evidence before the closing meeting.

Major vs Minor Nonconformity: What to Do After a Finding

Findings usually fall into three grades:

• Major nonconformity: a requirement is missing entirely or has broken down, raising doubt about whether the system can achieve its intended results
• Minor nonconformity: an isolated lapse that does not undermine the system as a whole
• Opportunity for improvement: an observation, not a nonconformity

A major finding can delay or block certification, or put an existing certificate at risk, until the registrar verifies your fix. Deadlines come from your registrar's rules, not from a single universal number. DNV, for example, allows up to 90 days to submit evidence of root cause analysis and implemented corrective action for a major nonconformity, normally followed by an on-site verification. Check your own registrar's contract for its exact deadlines.

A strong response to any nonconformity follows the same pattern as clause 10.2:

1. 1. Correction: what you did immediately to contain the issue.
2. 2. Root cause: why it happened, not just what happened.
3. 3. Corrective action: the change that stops it from recurring here or elsewhere.
4. 4. Evidence: records showing the action was implemented and is working.

How Long Does ISO Audit Preparation Take?

There is no single answer, because preparation time depends on your scope, the number of sites, and how mature your system already is. For a surveillance or recertification audit with a working system, the 12-week model above is a realistic plan.

A first certification takes longer because the system needs time to run and produce records before Stage 2. Auditors want to see evidence that the system has operated over time, such as completed internal audits, a management review, and closed corrective actions. Our ISO certification guide covers the full timeline and costs for a first certificate.

Use OSHA's Program Evaluation Guidance as a Readiness Check

US employers have a free readiness tool that most ISO checklists ignore. OSHA's Program Evaluation and Improvement guidance, part of its Recommended Practices for Safety and Health Programs, advises evaluating your program when it starts and at least once a year after that.

The guidance asks questions an ISO auditor will also ask:

• Are the core elements of the program fully in place?
• Are injury, illness, hazard, and concern reporting processes working as intended?
• Are you tracking leading indicators, not just injury rates?

OSHA also publishes a crosswalk that maps its Recommended Practices to ISO 45001 and ANSI/ASSP Z10, which makes it easy to use one review for both purposes. The Recommended Practices are voluntary, and OSHA does not cite employers for skipping them.

FAQ

Conclusion

A registrar audit rewards preparation that starts early and runs on evidence. Lock the scope and close old findings 12 weeks out, run an independent internal audit, close every corrective action with proof, hold a real management review, and test it all with a mock audit before audit week. Get workers ready to speak honestly, and treat any nonconformity as a root cause problem, not a paperwork problem.

Use this ISO audit checklist as your countdown, and the auditor will see a system that already does its job.

Which part of audit prep gives your team the most trouble: records, interviews, or corrective actions? Share it in the comments, and pass this checklist to the person running your next internal audit.