Audit Evidence for Clause 5.3: Who Owns What in the OH&S System

Why Clause 5.3 Is More Than an Org Chart

When auditors arrive at Clause 5.3 of ISO 45001, there is a temptation to tick the box the moment someone hands over an organisation chart and a job description. That is not auditing. That is document collection. The real question Clause 5.3 asks is whether the people who are supposed to own parts of the OH&S management system actually do own them, and whether they have the authority to act on that ownership.

Clause 5.3 requires top management to assign and communicate roles, responsibilities and authorities within the OH&S management system. It specifically calls out ensuring the OH&S management system conforms to the requirements of the standard, reporting on performance to top management, and promoting worker focus on OH&S. These are not administrative tasks. They are governance functions, and auditing them requires evidence that goes well beyond paperwork.

This article walks through the audit evidence you should be gathering when you audit Clause 5.3, the common gaps that get missed, and the interview and observation techniques that reveal whether accountability is real or just documented.

What the Clause Actually Requires

Before collecting evidence, you need to be precise about what the standard requires. Clause 5.3 of ISO 45001:2018 states that top management shall assign responsibility and authority for ensuring the OH&S management system conforms to the requirements of the standard, reporting on OH&S performance to top management, and promoting worker focus on the OH&S objectives and outcomes.

The clause also requires that these responsibilities and authorities be communicated at all relevant levels of the organisation. That word communicated is doing a lot of work. It means that the people who hold these responsibilities must know they hold them, and the people who interact with them must know it too.

There is no requirement for a dedicated OH&S manager or management representative in ISO 45001, unlike older standards. Top management can distribute these responsibilities across multiple roles. That flexibility is deliberate, but it also creates audit complexity. When responsibilities are spread across several people, you need to verify that the distribution is coherent and that nothing falls through the gaps.

The Three Core Evidence Categories

Documented Evidence

Start with documents, but do not stop there. The documents you want to see include role descriptions or position descriptions that reference OH&S responsibilities, an OH&S responsibility matrix or similar documented allocation, any documented authority levels for OH&S decisions such as stopping work, approving controls, or signing off risk assessments, and records showing communication of these responsibilities.

When reviewing job descriptions, look for specificity. A job description that says the operations manager is responsible for safety is not sufficient. You want to see whether it specifies what that means in practice. Does it include hazard identification? Does it include approval of safe work method statements? Does it include authority to stop work? Vague language in a job description is a flag worth noting.

Also check whether the documented responsibilities align with the rest of the management system. If the environmental health and safety coordinator is listed as responsible for incident investigation, check whether the incident procedure names that role. If the site supervisor is responsible for toolbox talks, check whether training records show they have been trained to conduct them. Inconsistencies between documents are evidence of a system that has not been properly integrated.

Interview Evidence

This is where Clause 5.3 audits either come alive or fall flat. Interview evidence is the primary way you test whether documented responsibilities are understood and enacted.

Start with the people who hold the assigned responsibilities. Ask them directly what their OH&S responsibilities are. Do not prompt them by reading from the job description. Let them tell you. If a safety manager cannot articulate their own responsibilities without referring to a document, that is a finding worth exploring. If a site supervisor thinks their only OH&S responsibility is filling in a hazard report form, but the documented system assigns them far more, you have a gap between documentation and reality.

Then go sideways. Ask workers who their point of contact is for OH&S concerns. Ask supervisors who they escalate to. Ask the HR manager whether they understand their role in ensuring new starters receive OH&S induction. The way responsibilities flow through an organisation is revealed by testing at multiple levels, not just at the top.

When interviewing top management, ask how they receive information about OH&S performance. If they say they get a monthly report, ask what is in it. Ask whether they have ever acted on it. Ask what decisions they have made as a result. This tests whether the reporting function required by Clause 5.3 is genuinely operating or whether it is a formality that nobody reads.

Observational Evidence

Observation is underused in Clause 5.3 audits because auditors treat it as a leadership and planning clause rather than an operational one. That is a mistake. Observation can tell you a great deal about whether responsibilities are real.

Watch how safety decisions are made during a site walk. If a hazard is identified during the audit, notice who responds. Does the supervisor step in? Do workers know who to call? Or does everyone look around waiting for someone else to act? That moment of uncertainty is evidence about how well responsibilities are understood in practice.

Look at noticeboards, toolbox talk records, and safety meeting minutes. Do they name the person responsible for follow up actions? Are those actions actually followed up? If every meeting minute shows actions assigned to the same person with no evidence of completion, that tells you something about whether accountability is functioning.

Common Audit Scenarios and What They Tell You

The Absent Management Representative

In organisations that have transitioned from OHSAS 18001, you sometimes encounter a system that was built around a single management representative. ISO 45001 does not require this role, but many organisations have kept it. The audit question is whether this concentration of responsibility has created a single point of failure.

If the OH&S manager is on leave and nobody else can answer basic questions about the system, that is a conformance issue under Clause 5.3. The standard requires responsibilities to be assigned and communicated at all relevant levels. A system that only functions when one person is present has not met that requirement.

The Delegated but Uninformed Supervisor

A very common finding is the supervisor who has been assigned OH&S responsibilities in the documented system but has never been told about it, or was told once at induction and has forgotten. This comes up frequently in industries with high supervisor turnover, such as construction, mining, and logistics.

The audit test is straightforward. Ask the supervisor what their OH&S responsibilities are. Ask how they know. Ask when they last reviewed their role description. If the answer is uncertain or vague, check whether there is any evidence of communication or training on those responsibilities. If the only evidence is a signature on an induction form from three years ago, you have a finding. Communication under Clause 5.3 is not a one time event.

The Reporting Loop That Does Not Close

Clause 5.3 specifically requires that someone is responsible for reporting OH&S performance to top management. Auditors often verify this by checking whether a report exists. But the deeper question is whether that report reaches top management and whether top management responds to it.

Ask to see the most recent OH&S performance report. Then ask a member of top management what it contained. If they cannot recall the key findings, or if they say they receive a report but it goes to their inbox unread, the reporting function is not working. The standard requires the function to operate, not just to be documented.

The Contractor Interface Gap

In organisations that use contractors heavily, Clause 5.3 audits regularly uncover a gap at the boundary between the organisation and its contractors. The internal OH&S responsibilities are documented, but nobody has been assigned responsibility for ensuring that contractor activities are integrated into the OH&S system.

Ask who is responsible for contractor OH&S induction, for verifying contractor compliance with site rules, and for including contractor incidents in the organisation’s incident reporting. If the answer is unclear, or if different people give different answers, you have found a gap in the assignment of responsibilities that Clause 5.3 requires to be addressed. This links directly to the procurement and contractor management requirements in Clause 8.1.4, but the root cause often sits in Clause 5.3.

Writing Findings Against Clause 5.3

Clause 5.3 findings need to be grounded in specific evidence, not general impressions. A finding that says roles and responsibilities are not clearly defined is weak. A finding that says the site supervisor for the Parramatta facility could not identify their OH&S responsibilities during interview, and no documented evidence of communication of OH&S responsibilities to that role was available beyond an induction sign off dated four years prior, is defensible and actionable.

When writing findings, link the evidence to the specific requirement. Clause 5.3 has three distinct functions: ensuring conformance, reporting on performance, and promoting worker focus. If your finding relates to the reporting function, say so. If it relates to communication of responsibilities, be specific about which level of the organisation is affected and what evidence was missing or contradictory.

For guidance on how to structure findings clearly, the article on how to write nonconformities that hold up covers the elements of a well constructed finding in detail.

Linking Clause 5.3 to Other Parts of the Audit

One of the most useful things you can do as an auditor is trace a Clause 5.3 finding through to its consequences elsewhere in the system. Roles and responsibilities underpin almost every other clause in ISO 45001. When they are unclear or uncommunicated, the effects show up downstream.

If the person responsible for hazard identification has not been told they hold that responsibility, the hazard register will be incomplete. If the person responsible for reviewing risk assessments has no authority to reject inadequate assessments, the risk assessment process will be ineffective. If nobody is responsible for ensuring corrective actions are closed, they will stay open indefinitely.

This means that when you find Clause 5.3 issues, look for corroborating evidence in the clauses that depend on those responsibilities being fulfilled. A pattern of weak evidence across Clause 5.3 and Clauses 6.1, 8.1, and 10.2 tells a more complete story than a single finding in isolation.

For a broader view of how to audit the OH&S management system as a whole, the article on auditing occupational health and safety under ISO 45001 provides useful context on how the clauses interact.

Practical Audit Questions for Clause 5.3

Below are interview questions that work well in Clause 5.3 audits. They are open questions designed to draw out real understanding rather than rehearsed answers.

• Can you walk me through your OH&S responsibilities in this role?
• How did you come to understand what those responsibilities are?
• If you identified a hazard that was beyond your authority to fix, what would you do and who would you contact?
• How does OH&S performance information get to the people who make decisions about resources and priorities?
• When did you last receive an update on the OH&S performance of the site or organisation?
• If a worker came to you with a safety concern, what would happen next?
• Who is responsible for making sure contractors follow your OH&S rules on site?
• Has there been a change in personnel in any OH&S role in the past twelve months? How were those responsibilities handed over?

These questions work for different levels of the organisation. The last question is particularly useful because role transitions are a common point of failure. When someone leaves and their OH&S responsibilities are not formally transferred, the system develops gaps that often go unnoticed until an audit or an incident.

Auditing Clause 5.3 in Small Organisations

In small businesses, the owner or director often holds most OH&S responsibilities personally. This is legitimate under ISO 45001, but it creates specific audit challenges. You need to verify that the person holding those responsibilities actually has the capacity to fulfil them, and that there is a plan for continuity if they are unavailable.

Ask the owner what they do when they are away from the site. Who has authority to stop work if a hazard is identified? Who is responsible for ensuring the risk register is reviewed? If the answer is nobody, or it all waits until I get back, you have a finding. The standard does not require a large team, but it does require that responsibilities are assigned and that the system can function.

For small organisations that are new to ISO 45001, the article on the roles, responsibilities and authorities under Clause 5.3 of ISO 45001 provides a plain English breakdown of what the clause requires and how to document it practically.

What Good Looks Like

An organisation that has genuinely embedded Clause 5.3 will show you several things without being asked. Role descriptions will reference specific OH&S functions. People at every level will be able to articulate their responsibilities without hesitation. The reporting chain will be clear and evidenced by actual reports that have been received and acted upon. Workers will know who to go to. Supervisors will know their authority limits. And when you probe at the edges, such as contractors, shift handovers, or recent role changes, the system will hold together.

That coherence is what you are testing for. Clause 5.3 is not about having the right documents. It is about having a system where people know what they own, have the authority to act on it, and are connected to the information they need to do their job. When that is working, the rest of the OH&S management system tends to work too.

If you are developing your skills in auditing ISO 45001 and want to understand how to gather evidence across all clauses, not just leadership, the ISO 45001 internal auditor and lead auditor courses at Audit Workshop are built around real audit scenarios. The training is delivered by a lead auditor with over 500 external certification audits across Australia and the region, so the examples and techniques you learn reflect what actually happens on audit day, not just what the standard says.