How Auditors Evaluate OH&S Opportunity Assessment in Clause 6.1.2.3

Why Clause 6.1.2.3 Gets Skipped and Why That Is a Problem

Ask most auditors what they look for in Clause 6.1 of ISO 45001 and you will hear about hazard identification, risk assessment, and the legal register. Those are the obvious ones. They generate findings, they have records attached, and people know they are coming.

Clause 6.1.2.3 is different. It sits quietly after the risk assessment clauses and asks organisations to identify OH&S opportunities. Not risks. Not hazards. Opportunities. And because it does not have the same compliance weight as the clauses around it, it often gets treated as a tick and flick exercise, or skipped altogether.

That is a problem for two reasons. First, the standard genuinely requires it. A nonconformity against Clause 6.1.2.3 is a legitimate finding. Second, and more practically, organisations that do not actively identify opportunities for improving their OH&S performance tend to plateau. Their systems stay compliant but never improve. The opportunity assessment is one of the mechanisms ISO 45001 uses to drive genuine progress, not just maintenance of the status quo.

This article is for auditors who want to evaluate Clause 6.1.2.3 properly, not just check whether a document exists. We will look at what the clause actually requires, what good practice looks like in the field, and the questions and evidence that will tell you whether an organisation is genuinely engaging with OH&S opportunities or just going through the motions.

What Clause 6.1.2.3 Actually Requires

The clause sits within the broader planning structure of ISO 45001 Clause 6.1, which addresses actions to address risks and opportunities. After Clause 6.1.2.1 covers hazard identification and Clause 6.1.2.2 covers OH&S risk assessment, Clause 6.1.2.3 turns to opportunities.

The standard requires organisations to assess OH&S opportunities to enhance OH&S performance. It specifically mentions opportunities to adapt work, work organisation, and the work environment to workers. It also requires assessment of other opportunities, which is an intentionally broad category that includes things like new technologies, better practices, and improvements identified through monitoring and incident investigation.

There is an important companion requirement here. The clause also asks organisations to assess opportunities for the OH&S management system itself, not just OH&S performance in the field. This means looking at whether the system can be made more effective, not just whether the workplace can be made safer.

The clause does not prescribe a specific method for doing this assessment. It does not require a particular form or register. What it does require is that the assessment actually happens, that it is documented in a way that gives the organisation something to act on, and that identified opportunities feed into the planning process under Clause 6.1.4.

The Difference Between Risk Assessment and Opportunity Assessment

One of the first things to clarify when auditing this clause is whether the organisation understands the distinction between risk assessment and opportunity assessment. Many organisations conflate the two, treating opportunities as simply the absence of risk. That is not what ISO 45001 intends.

Risk assessment asks: what could go wrong and how bad could it be? Opportunity assessment asks: what could we do better, and what would that improvement look like in practice?

A risk assessment might identify that working at height creates a fall risk. An opportunity assessment might identify that a new elevated work platform design could eliminate the need for certain tasks to be performed at height at all, removing the risk rather than just controlling it. That is an opportunity. It is proactive rather than reactive.

Other examples of genuine OH&S opportunities include:

• Introducing ergonomic equipment that reduces manual handling injuries across a work area
• Redesigning a task to reduce noise exposure rather than relying on hearing protection
• Implementing a fatigue management programme that goes beyond minimum legal requirements
• Using incident data trends to identify systemic improvements before injuries occur
• Improving worker consultation processes so hazards are identified earlier
• Adopting a new inspection technology that provides better data on plant condition

When you are auditing, you are looking for evidence that the organisation is thinking in these terms, not just listing hazards with a positive spin.

What to Look for Before the Site Walk

Before you get to the floor, spend time with the documented information. The opportunity assessment does not need to be a standalone document, but the evidence of it needs to exist somewhere. Here is what to look for.

Is There a Documented Process?

The organisation should be able to show you how they identify and assess OH&S opportunities. This might be embedded in their hazard management procedure, their planning process, or a separate OH&S improvement procedure. The format matters less than the substance. Ask to see the process and then check whether the outputs match what the process describes.

Are Opportunities Recorded Somewhere Accessible?

Look for a register, a planning log, or meeting minutes that capture identified opportunities. These might be in a dedicated OH&S opportunity register, embedded in the risk register with a separate column, or captured in management review outputs. The key question is whether opportunities are being recorded and tracked, or whether they exist only in someone's head.

Do the Records Show Genuine Assessment?

A list of vague statements like “improve safety culture” or “reduce incidents” is not an opportunity assessment. Genuine assessment includes some consideration of what the opportunity involves, what improvement it would deliver, and what action has been or will be taken. Look for specificity. If the records are all high level and generic, that is worth probing.

Is There a Link to Clause 6.1.4?

Clause 6.1.4 requires organisations to plan actions to address risks and opportunities. Check whether identified opportunities from Clause 6.1.2.3 are flowing through to planned actions. If opportunities are being identified but never actioned, the system is not working as intended. You can trace this thread by comparing the opportunity register against the action plan or OH&S objectives.

Audit Questions That Get Honest Answers

The interview is where you find out whether the system is real or just paper. These questions work well for the OH&S Manager, supervisors, and workers.

For the OH&S Manager or Management Representative

• Can you walk me through how your organisation identifies OH&S opportunities, not just risks?
• What sources of information do you use to identify opportunities? Incident data, near miss reports, audits, worker feedback?
• Can you give me a recent example of an OH&S opportunity that was identified and acted on?
• How do identified opportunities get turned into planned actions?
• How does top management get visibility of OH&S opportunities?
• Has the opportunity assessment process itself changed or improved in the last 12 months?

For Supervisors and Team Leaders

• Have you or your team ever suggested a way to make the work safer or easier? What happened with that suggestion?
• Are there any tasks in your area where you think the way work is organised could be improved from a safety perspective?
• Does the organisation ask for your input on safety improvements, or does it mostly come from above?

For Workers

• If you spotted a way to do your job more safely, how would you raise it?
• Have you ever seen a safety suggestion from someone in your team get acted on?
• Do you feel like the organisation is actively looking for ways to improve safety, or mainly focused on avoiding incidents?

The worker interviews are particularly revealing. Organisations that are genuinely engaging with OH&S opportunities tend to have workers who can describe specific examples of improvements. Organisations that are going through the motions tend to have workers who look blank or say everything is handled by the safety team.

Common Gaps Auditors Find Against Clause 6.1.2.3

After conducting hundreds of external certification audits across a range of industries, certain patterns keep appearing when it comes to this clause. Here are the most common gaps.

The Opportunity Assessment Is Indistinguishable from the Risk Assessment

Some organisations add a column to their risk register labelled “opportunity” and populate it with statements like “no opportunity identified” for every row. This satisfies no one. The opportunity assessment needs to demonstrate genuine thinking about improvement, not just confirmation that no opportunities were spotted.

Opportunities Are Identified but Never Actioned

This is probably the most common gap. The organisation has a list of opportunities, sometimes a quite good one, but there is no evidence that any of them have been progressed. There is no action plan, no owner, no timeline, and no follow up. When you ask about a specific opportunity from the list, the answer is usually “we are still looking into that.”

The Assessment Is Done Once and Never Reviewed

Clause 6.1.2.3 is not a one time exercise. Opportunities should be reviewed regularly, particularly when circumstances change, when incidents occur, or when new information becomes available. If the opportunity assessment document has not been updated in two years, that is a flag.

Worker Input Is Absent

ISO 45001 places significant emphasis on worker participation throughout the standard. Clause 5.4 specifically requires consultation and participation of workers in the OH&S management system. An opportunity assessment that has been developed entirely by management without any worker input is likely to miss practical improvement opportunities that workers can see every day. It is also likely to indicate a gap against Clause 5.4 as well as Clause 6.1.2.3.

The Management System Opportunities Are Ignored

Most organisations focus their opportunity assessment on the physical work environment and forget the second part of the clause, which covers opportunities for the OH&S management system itself. Ask specifically about system opportunities. Has the organisation considered whether their audit programme is effective? Whether their incident investigation process could be improved? Whether their training approach is delivering the right competence? These are system opportunities and they belong in the assessment.

Grading the Finding: Observation, Minor, or Major?

Deciding how to grade a finding against Clause 6.1.2.3 requires judgement. Here is a rough guide based on what you find.

An observation or opportunity for improvement is appropriate when the process exists and is broadly working, but there are gaps in rigour, frequency, or depth. For example, opportunities are identified but the assessment lacks detail, or the review cycle is longer than it should be.

A minor nonconformity is appropriate when the process exists but there are systematic failures in implementation. For example, opportunities are identified but there is no evidence they are being actioned, or worker input is consistently absent, or the management system opportunities are not being considered at all.

A major nonconformity is appropriate when there is no evidence that an opportunity assessment is being conducted at all, or when the organisation cannot demonstrate any link between identified opportunities and planned actions across multiple review cycles. A major finding here would typically be supported by other gaps in Clause 6.1 and Clause 10 as well.

For more guidance on how to classify and document findings, the article on audit questions for OH&S risk assessment under Clause 6.1.2.2 covers the broader risk assessment context that sits alongside this clause, and the post on risks and opportunities in ISO 45001 Clause 6.1.1 explains the overarching planning framework.

Linking Clause 6.1.2.3 to Other Parts of the Audit

Clause 6.1.2.3 does not exist in isolation. When you audit it, you should be drawing threads to other parts of the system.

Clause 5.4 Worker Consultation: If workers are not involved in the opportunity assessment, that is relevant to both clauses. Do not raise two separate findings for the same root cause, but note the connection in your audit trail.

Clause 6.2 OH&S Objectives: Opportunities that have been identified should be informing the organisation's OH&S objectives. If the objectives are entirely disconnected from the opportunity assessment, that is a gap in planning integrity.

Clause 9.1.1 Monitoring and Measurement: Incident data, near miss trends, and monitoring results are primary sources for identifying opportunities. Check whether the organisation is actually using this data to feed the opportunity assessment.

Clause 10.1 Improvement: The opportunity assessment is one of the mechanisms through which continual improvement is supposed to happen. If the improvement clause has no substance, look back at whether the opportunity assessment is generating anything actionable.

The article on auditing OH&S objectives against Clause 6.2.1 is worth reading alongside this one, as it covers how planned improvements should translate into measurable targets.

What Good Looks Like in Practice

To give you a benchmark, here is what a well functioning opportunity assessment process looks like in a mid sized manufacturing organisation.

The OH&S Manager maintains a living opportunity register that is reviewed quarterly by the safety committee, which includes worker representatives. Sources feeding into the register include incident investigation outcomes, near miss reports, audit findings, worker suggestions submitted through a simple online form, benchmarking against industry guidance, and outputs from the annual management review.

Each opportunity is assessed against a simple set of criteria: what improvement would it deliver, what resources would it require, and what is the priority relative to other planned actions. The top opportunities are incorporated into the OH&S objectives for the year, with owners and timelines assigned.

When you interview workers on the floor, they can point to specific examples of changes that came from suggestions they or their colleagues made. The maintenance team can describe a recent change to a machine guarding design that came out of a near miss investigation. The warehouse supervisor can tell you about a new trolley system that reduced manual handling injuries.

That is genuine engagement with Clause 6.1.2.3. It is not a form. It is a habit.

Building Your Audit Trail for This Clause

When you document your audit of Clause 6.1.2.3, make sure your notes capture:

• What documented evidence of the opportunity assessment exists and where it is located
• The sources of information the organisation uses to identify opportunities
• Whether worker input is present and how it is captured
• Whether management system opportunities are being considered alongside physical work environment opportunities
• The link between identified opportunities and planned actions or objectives
• The review frequency and whether it is appropriate to the organisation's context
• Specific examples discussed during interviews and whether they were consistent with the documented record

If you are raising a finding, your nonconformity statement should be specific. Avoid generic statements like “the opportunity assessment is inadequate.” Instead, describe exactly what is missing or what was found not to conform. For example: “The organisation's OH&S opportunity register, last updated in March 2023, contains six identified opportunities, none of which have associated actions, owners, or timelines. There is no evidence that identified opportunities have been incorporated into the OH&S objectives for the current planning cycle.” That is a finding that can be acted on.

For auditors who want to strengthen their skills in writing findings that are specific and defensible, the post on how to audit Clause 6.1.1 planning for risks and opportunities provides complementary guidance on the broader planning audit trail.

Practical Advice for Internal Auditors

If you are an internal auditor preparing to audit this clause in your own organisation, a few practical tips.

Do not audit this clause in isolation from the rest of Clause 6. The opportunity assessment makes most sense when you can see how it connects to the risk assessment, the legal register, and the planning actions. Build your audit plan so you can follow the thread from hazard identification through to planned action.

Talk to workers before you look at documents. If you go to the documents first, you will be tempted to accept what is written. If you talk to workers first, you will have a clearer sense of whether the documented process reflects reality. Workers who are genuinely involved in identifying opportunities will be able to give you concrete examples without prompting.

Be specific in your questions. “Do you identify OH&S opportunities?” is a yes or no question that will always get a yes. “Can you show me the last three opportunities that were identified and tell me what happened with each of them?” is a question that will tell you whether the process is real.

If you are building your skills in ISO 45001 auditing and want to develop a more confident approach to clauses like 6.1.2.3, the auditing occupational health and safety under ISO 45001 article provides a broader framework for approaching the standard as a whole.

Training That Covers the Detail

Auditing Clause 6.1.2.3 well requires more than reading the standard. It requires understanding how the clause fits into the broader OH&S planning framework, what good practice looks like across different industries, and how to ask questions that reveal whether an organisation is genuinely engaging with improvement or just maintaining a document trail.

At Audit Workshop, the ISO 45001 Internal Auditor and Lead Auditor courses are built around practical audit scenarios drawn from real certification audits. Dilawar Laghari, who has conducted over 500 external ISO certification audits, brings the kind of field experience that makes these nuanced clauses easier to understand and audit with confidence. Whether you are preparing for your first internal audit or working toward lead auditor certification, the training covers the planning clauses in the depth they deserve.