How to Audit Organisational Context Under ISO 45001 Clause 4.1

Why Clause 4.1 Is Not a Formality

When auditors arrive at an organisation for an ISO 45001 audit, Clause 4.1 is often treated as a warm-up. A quick look at the context document, a tick in the box, and then on to the more operationally visible clauses. That approach misses the point entirely.

Clause 4.1 of ISO 45001 asks the organisation to understand itself and the environment it operates in. That understanding is supposed to drive everything else in the OH&S management system. If the context analysis is shallow or disconnected from real operations, the risks, objectives, and controls built on top of it will be equally shallow. Auditing organisational context under ISO 45001 is about verifying that the foundation is solid, not just present.

This article walks through what Clause 4.1 actually requires, what good evidence looks like, what weak evidence looks like, and the specific questions and techniques that experienced auditors use to test whether the context analysis is genuinely informing the OH&S management system.

What Clause 4.1 Actually Requires

The clause is short. ISO 45001 Clause 4.1 requires the organisation to determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of the OH&S management system.

That is it, in terms of the normative text. There is no requirement to produce a specific document format, no prescribed method, and no list of mandatory issues to consider. What the standard requires is that the determination happens, that it is relevant to OH&S specifically, and that it actually influences the system.

The intended outcomes of the OH&S management system are defined in Clause 1 of the standard. They include preventing work-related injury and ill health, providing safe and healthy workplaces, and continually improving OH&S performance. So when you are auditing Clause 4.1, the question is not just whether the organisation has listed some internal and external issues. The question is whether those issues are relevant to those outcomes.

Internal Issues

Internal issues are factors within the organisation that could affect OH&S outcomes. Common examples include:

• The nature of work activities, including high-risk tasks such as working at heights, confined space entry, or heavy plant operation
• Workforce composition, including contractors, labour hire workers, and shift arrangements
• Organisational culture, including attitudes toward safety, near miss reporting behaviours, and management commitment
• Physical infrastructure, including the age and condition of plant, equipment, and facilities
• Recent incidents, injuries, or near misses and what they reveal about systemic issues
• Organisational change, including restructures, new processes, or leadership changes
• Worker competence levels and the effectiveness of training programmes

External Issues

External issues are factors outside the organisation that it cannot fully control but must account for. In the OH&S context, these commonly include:

• Legislative and regulatory requirements under the relevant state or territory WHS Act and Regulations, as well as Commonwealth legislation where applicable
• Industry codes of practice and safe work method statements relevant to the sector
• Client and principal contractor requirements for organisations working on third-party sites
• Supply chain factors, including the safety practices of contractors and subcontractors
• Environmental conditions, including climate, weather, and site geography
• Emerging hazards in the industry, such as psychosocial risks, heat stress, or silica dust exposure
• Technological changes that affect how work is performed
• Economic pressures that may influence resourcing decisions affecting safety

For a useful comparison of how Clause 4.1 sits across the three main management system standards, see our article on ISO 9001 vs ISO 14001 vs ISO 45001: Key Differences Explained.

The Audit Challenge: Substance Over Documentation

The most common weakness auditors find in Clause 4.1 is not absence of documentation. Most organisations have a context of the organisation document. The weakness is that the document is generic, static, and disconnected from what the organisation actually does.

A context analysis that lists regulatory requirements as an external issue without naming the specific legislation, or lists workplace culture as an internal issue without any analysis of what the actual culture is, tells you very little. It tells you the organisation knows what categories of issues exist. It does not tell you the organisation has genuinely thought about its specific situation.

As an auditor, your job is to test the substance behind the document. That means going beyond the register and asking questions that reveal whether the analysis is alive and connected to the rest of the system.

Planning Your Approach to Auditing Clause 4.1

Before the audit begins, review whatever context documentation the organisation has produced. This might be a SWOT analysis, a PESTLE analysis, a context register, a risk register that incorporates contextual factors, or simply a narrative document. The format matters less than the content.

During your document review, ask yourself:

• Are the issues listed specific to this organisation and its operations, or are they generic enough to apply to any organisation?
• Do the internal issues reflect the actual hazard profile of the work being done?
• Do the external issues reference actual legislation, codes of practice, and industry-specific requirements?
• Is there evidence that this analysis has been reviewed or updated recently?
• Can you trace a connection between the issues identified here and the risks and opportunities addressed in Clause 6.1?

That last point is critical. Clause 4.1 is not a standalone exercise. It feeds into Clause 4.2 (interested parties), Clause 4.3 (scope), and most directly into Clause 6.1 (actions to address risks and opportunities). If you cannot trace a logical connection from the context analysis through to the planning clauses, that is a finding worth raising.

Interview Questions That Reveal the Depth of Context Analysis

Document review alone will not tell you whether the context analysis is genuine. You need to interview people. The most useful interviews for Clause 4.1 are with top management and with the person or team responsible for maintaining the OH&S management system.

Here are specific questions that experienced auditors use:

Questions for Top Management

• Can you walk me through the main external pressures affecting your ability to manage safety in this business right now?
• What internal factors do you think pose the greatest challenge to achieving your OH&S objectives?
• How has the context of the business changed in the last twelve months, and how has that been reflected in your safety system?
• What legislative or regulatory changes have affected your operations recently, and how did you respond?
• If I spoke to your workers, what would they say about the safety culture here?

Questions for the OH&S Manager or System Owner

• How did you go about identifying the issues listed in your context analysis?
• How often is this analysis reviewed, and what triggers an unplanned review?
• Can you show me where these issues have influenced your risk assessment or your OH&S objectives?
• Are there any significant issues that have emerged recently that are not yet reflected in this document?
• How do you ensure that workers and supervisors contribute to the understanding of internal issues?

The answers to these questions will quickly reveal whether the context analysis is a living document or a compliance artefact that was produced for certification and has not been touched since.

Common Nonconformities Against Clause 4.1

Having conducted hundreds of external ISO certification audits, the patterns that emerge in Clause 4.1 nonconformities are fairly consistent. Understanding these patterns helps you focus your audit time on the areas most likely to reveal genuine gaps.

The Generic Context Document

The organisation has a document that lists broad categories of issues without specificity. For a demolition contractor, the context analysis looks identical to what you might find at a software company. There is no mention of specific hazards like asbestos, falling debris, or structural collapse. There is no reference to specific legislation like the relevant WHS Regulations or codes of practice for demolition work.

This is not necessarily a nonconformity on its own, but when combined with a risk register that also lacks specificity, you have a systemic issue that warrants a nonconformity against Clause 4.1 for failure to determine issues relevant to the OH&S management system and its intended outcomes.

No Evidence of Review

The context document was produced during the initial implementation and has never been updated. The organisation has since taken on new work types, hired a significant number of contractors, experienced a serious incident, or had a change in leadership. None of this is reflected in the context analysis.

ISO 45001 does not specify a review frequency for Clause 4.1, but Clause 10.3 on continual improvement and Clause 9.3 on management review both create an expectation that the system responds to change. A static context document in a changing organisation is a legitimate finding.

Disconnection From Planning

The context analysis identifies significant issues, but those issues have not been carried through into the risk and opportunity assessment in Clause 6.1. For example, the context document acknowledges that the organisation operates in a high-turnover sector with a large proportion of new and inexperienced workers. But the risk register does not address the elevated risk associated with inexperienced workers, and there are no specific controls or objectives related to induction quality or supervision of new workers.

This disconnection is one of the most common and most significant findings in Clause 4.1 audits. The context analysis exists, but it is not driving the system.

OH&S Specific Issues Missing

Some organisations produce a single context analysis for their entire management system and apply it equally to quality, environment, and OH&S. The problem is that the OH&S context has specific dimensions that a generic analysis often misses. Psychosocial hazards, fatigue management, the influence of production pressure on safety decisions, and the specific legislative framework under the WHS Act are all OH&S-specific issues that need to appear in the context analysis if they are relevant.

For more on what auditors look for in an ISO 45001 audit more broadly, our article on Auditing Occupational Health and Safety Under ISO 45001 covers the full picture.

Testing the Connection to Clause 6.1

One of the most effective audit techniques for Clause 4.1 is to pick two or three significant issues from the context analysis and trace them forward into the planning clauses. This is sometimes called vertical tracing or following the audit trail.

For example, if the context analysis identifies that the organisation operates in a sector with significant psychosocial risks, including high-pressure deadlines, fatigue, and workplace violence, you would then look for evidence that:

1. Clause 6.1.2 hazard identification has addressed psychosocial hazards specifically
2. The risk assessment has evaluated the likelihood and consequence of these hazards
3. Controls have been implemented, whether through workload management, fatigue policies, or incident reporting mechanisms
4. OH&S objectives in Clause 6.2 include something measurable related to psychosocial risk

If you find the context analysis mentions psychosocial risk but the hazard register only covers physical hazards, you have found a systemic gap that can be traced back to Clause 4.1 failing to drive the system.

This technique of following the audit trail is covered in more detail in our article on Understanding the ISO 45001 Hazard Identification Audit Trail.

Sector-Specific Considerations for Australian Auditors

Auditing Clause 4.1 in Australia has some specific dimensions that auditors need to be aware of. The harmonised WHS legislative framework, while consistent across most states and territories, has some jurisdictional variations. Western Australia and Victoria have their own legislative frameworks that differ in some respects from the model WHS Act. An organisation operating across multiple states needs a context analysis that acknowledges these variations.

The concept of a Person Conducting a Business or Undertaking (PCBU) is central to Australian WHS law and should appear in the context analysis of any Australian organisation seeking ISO 45001 certification. If it does not, that is worth exploring in the audit.

Industry-specific codes of practice are also part of the external context. A construction company should be referencing relevant codes such as those for managing the risk of falls or safe design of structures. A mining contractor should reference the relevant mining regulations. An aged care provider should reference the specific risks associated with patient handling, aggression, and fatigue. If these sector-specific requirements are absent from the context analysis, the analysis is incomplete.

Documenting Your Audit Findings for Clause 4.1

When you raise a finding against Clause 4.1, it needs to be specific and evidence-based. Avoid vague statements like the context analysis is insufficient. Instead, document exactly what you observed, what evidence you reviewed, and how it demonstrates nonconformity with the specific requirement of the clause.

A well-written nonconformity for Clause 4.1 might read:

The organisation's context of the organisation register, version dated 14 months prior to the audit, identifies high staff turnover as a significant internal issue. Review of the OH&S risk register, worker induction records, and OH&S objectives for the current period found no evidence that this issue has been addressed through hazard identification, risk controls, or measurable objectives. The organisation has not demonstrated that the determination of internal issues relevant to its OH&S management system has been used to inform planning, as required by ISO 45001 Clause 4.1.

That kind of finding is specific, traceable, and gives the organisation a clear path to corrective action. For guidance on writing nonconformities that hold up to scrutiny, see our article on How to Write Nonconformities That Hold Up.

Observations and Opportunities for Improvement

Not every weakness you find in Clause 4.1 will meet the threshold for a nonconformity. Some issues are better raised as observations or opportunities for improvement. For example:

• The context analysis is adequate but has not been reviewed in eighteen months despite a significant change in the organisation's contract base
• The analysis addresses most relevant issues but does not explicitly reference emerging psychosocial risk guidance from Safe Work Australia
• The connection between context issues and objectives is present but not clearly documented, making it difficult for new team members to understand the rationale

These are genuine improvement opportunities that a thorough auditor will note, even if they do not rise to the level of a formal nonconformity.

Building Your Competence in Auditing Clause 4

Auditing the context clauses well requires a combination of technical knowledge of the standard, sector awareness, and strong interviewing skills. Many auditors who are comfortable in the operational clauses find Clause 4 more challenging because it deals with strategic and systemic issues rather than observable procedures and records.

If you want to build your competence in auditing ISO 45001 from Clause 4 through to Clause 10, Audit Workshop offers ISO 45001 Internal Auditor and Lead Auditor training delivered by Dilawar Laghari, a certified lead auditor with over 14 years of compliance experience and more than 500 external certification audits across Australia, the Middle East, and South Asia. The training is practical and grounded in real audit scenarios, not just theory. You can explore the available courses at auditworkshop.com.