Audit Questions for OH&S Risk Assessment Under Clause 6.1.2.2

Why Clause 6.1.2.2 Deserves Careful Audit Attention

Clause 6.1.2.2 of ISO 45001 sits at the heart of the OH&S management system. It requires organisations to assess the OH&S risks associated with identified hazards, taking into account the effectiveness of existing controls. If that process is weak, everything downstream suffers. Risk controls get selected without adequate basis. Objectives get set without understanding what actually threatens workers. And when incidents occur, the root cause often traces straight back to a risk assessment that was never rigorous to begin with.

For auditors, this clause is one of the most revealing areas to examine. A well conducted audit of Clause 6.1.2.2 tells you whether the organisation genuinely understands its risk profile, or whether the risk register is a document that gets updated once a year and then filed away. This article gives you a practical set of audit questions, explains what evidence to look for, and flags the common weaknesses that show up in real audits.

What Clause 6.1.2.2 Actually Requires

Before you write a single audit question, you need to be clear on what the clause demands. ISO 45001 Clause 6.1.2.2 requires the organisation to establish, implement and maintain a process to assess OH&S risks and other risks to the OH&S management system. The assessment must take into account the effectiveness of existing controls. It must also consider applicable legal requirements and other requirements.

The standard does not prescribe a specific risk assessment methodology. That is intentional. Organisations can use a risk matrix, a bow tie analysis, a job safety analysis, or any other systematic approach, provided the methodology is consistent, produces comparable results, and is applied across all relevant hazards. Your job as an auditor is not to evaluate which methodology they chose. Your job is to determine whether the chosen methodology is actually working.

Clause 6.1.2.2 also connects directly to what came before it. Hazards should have been identified under Clause 6.1.2.1. The risk assessment then takes those hazards and evaluates the likelihood and consequence of harm, considering what controls are already in place. If the hazard identification was incomplete, the risk assessment will be incomplete too. That is worth remembering when you plan your audit trail.

For a deeper look at how hazard identification feeds into the risk assessment process, the article on Hazard Identification Under Clause 6.1.2.1: What ISO 45001 Requires covers the upstream requirements in detail.

Planning Your Audit of Clause 6.1.2.2

Start With the Documented Process

Request the organisation's risk assessment procedure or methodology document before you arrive on site. Review it for the following: Does it define how likelihood and consequence are evaluated? Does it specify how existing controls are factored into the rating? Does it define what constitutes an acceptable risk level? Does it require reassessment when changes occur? These are the structural questions. If the procedure cannot answer them, the risk assessment process has no real foundation.

Identify Which Risk Assessments to Sample

Most organisations will have multiple risk assessments covering different work areas, tasks, or hazards. You cannot review all of them. Choose your sample based on risk. Prioritise high risk activities such as working at heights, confined space entry, energised electrical work, plant operation, and chemical handling. Also select at least one or two assessments for routine lower risk tasks. This gives you a sense of whether the methodology is applied consistently across the board, not just for the obvious hazards.

If the organisation has had recent incidents or near misses, pull the risk assessment for that activity. It will tell you whether the risk was recognised before the incident occurred, and if so, whether the controls were adequate.

Core Audit Questions for Clause 6.1.2.2

Questions About the Risk Assessment Process

These questions are aimed at the OH&S Manager, the WHS Coordinator, or whoever owns the risk assessment process. Ask them in a conversational way. You are trying to understand how the process actually works, not just what the procedure says.

• Can you walk me through how you conduct a risk assessment for a new or changed task?
• What methodology do you use to rate likelihood and consequence, and how was that methodology selected?
• How do you factor in the effectiveness of existing controls when you assign a risk rating?
• What risk level is considered acceptable, and what happens when a risk is rated above that threshold?
• Who is involved in conducting risk assessments, and what competence do they need to participate?
• How do you ensure that risk assessments are reviewed and kept current?
• What triggers a reassessment of an existing risk assessment?
• How are legal requirements and other requirements considered during the risk assessment?

Questions About Specific Risk Assessments

Once you have reviewed a sample of risk assessments, use these questions to probe the detail. Pick one or two assessments and work through them with the person responsible.

• This hazard is rated as medium risk. Can you explain how you arrived at that rating?
• The existing controls listed here include PPE and a procedure. How did you assess the effectiveness of those controls before assigning the residual risk rating?
• When was this risk assessment last reviewed, and what prompted that review?
• Has anything changed in this work area or task since this assessment was completed?
• How do workers in this area know what the risk rating is and what controls apply?
• This assessment lists a legal requirement. Can you show me where that requirement appears in your compliance register?

Questions to Ask Workers on the Floor

Do not limit your audit to the management team. Walk the floor and talk to the people doing the work. Their answers will tell you whether the risk assessment is a live document or a filing cabinet exercise.

• Have you been involved in a risk assessment for the work you do here?
• Do you know what the main risks are for your job, and what controls are in place?
• If you identified a new hazard or thought the risk rating was wrong, what would you do?
• Has the risk assessment for this task been updated recently? Do you know why?

These questions connect directly to the worker participation requirements under Clause 5.4 of ISO 45001. If workers have no idea a risk assessment exists, or have never been consulted during the process, you are looking at a potential nonconformity against both Clause 5.4 and Clause 6.1.2.2.

What Evidence to Gather

Documents and Records

The most common evidence for Clause 6.1.2.2 includes the risk assessment procedure or methodology, completed risk assessments across a range of activities, risk matrices or rating tools used, records of review and update dates, and evidence that legal requirements have been considered. Look also for records of who conducted the assessment, who approved it, and when it was last reviewed.

Pay attention to version control. If a risk assessment was completed three years ago and has never been updated despite significant changes to the work process, that is a finding. The standard requires the process to be maintained, which implies it must stay current.

Observation Evidence

When you walk the site, look at whether the controls identified in the risk assessments are actually in place. If a risk assessment says the control for a particular chemical hazard is a specific type of glove, and workers are using a different type or none at all, that is a gap between the documented control and the actual control. The risk rating may have been based on a control that does not exist in practice.

This is one of the most powerful pieces of evidence you can gather. It demonstrates not just a documentation problem, but a fundamental failure in the risk assessment process, because the effectiveness of controls was assessed against controls that were never reliably implemented.

Interview Evidence

Record what people tell you, including direct quotes where possible. If the OH&S Manager tells you that risk assessments are reviewed annually, but the records show the last review was 28 months ago, you have a conflict between interview evidence and documentary evidence. Note both. That conflict itself is significant.

The article on Auditing Hazard Identification: Is the Process Ongoing and Proactive? has useful guidance on how to triangulate evidence across these three sources when auditing the planning clauses of ISO 45001.

Common Nonconformities Under Clause 6.1.2.2

Risk Ratings That Ignore Existing Controls

One of the most frequent issues is a risk matrix that rates inherent risk rather than residual risk. The organisation lists controls, but the risk rating does not change based on whether those controls are effective or even present. The standard is explicit: the assessment must take into account the effectiveness of existing controls. If the methodology does not do this, the process does not conform.

Inconsistent Application of the Methodology

Some organisations have a perfectly reasonable risk assessment procedure on paper, but the completed assessments look nothing like it. Different people have used different rating scales. Some assessments have detailed control descriptions while others just say “refer to procedure”. The methodology is not being applied consistently, which means the results are not comparable. This is a systemic issue, not just a documentation gap.

No Defined Acceptable Risk Level

The organisation cannot tell you what risk rating is acceptable and what is not. There is no threshold. This means there is no logical basis for deciding when additional controls are needed. Without a defined acceptable level, the risk assessment process has no decision making function. It is just a form filling exercise.

Risk Assessments That Have Not Been Updated

Outdated risk assessments are extremely common. The trigger for review is often absent from the procedure, or the procedure specifies a review interval that is not being followed. Changes to plant, processes, chemicals, or personnel happen without triggering a reassessment. This is particularly problematic in dynamic work environments like construction, manufacturing, and mining.

No Evidence of Worker Involvement

Risk assessments signed off only by management, with no evidence that workers performing the tasks were consulted, are a recurring finding. Workers often have the most detailed knowledge of how a task is actually performed and where the risks lie. Excluding them from the process undermines both the quality of the assessment and the requirements of Clause 5.4.

For context on what common failures look like across the planning clauses of ISO 45001, the article on Clause 6 of ISO 45001: The Most Common Nonconformities is worth reviewing as part of your audit preparation.

Grading Your Findings

Not every weakness you find will be a nonconformity. Some issues are better recorded as observations or opportunities for improvement. Here is a rough guide to grading what you find under Clause 6.1.2.2.

A major nonconformity is appropriate when the risk assessment process does not exist in any meaningful form, when assessments are so outdated or incomplete that significant hazards have no assessed risk rating, or when the organisation cannot demonstrate that existing controls have been considered at all. A major finding is also warranted when the absence of a functioning risk assessment process has contributed to a serious incident.

A minor nonconformity is appropriate when the process exists and generally works, but specific assessments are overdue for review, the methodology is inconsistently applied across departments, or there are isolated gaps in the evidence of worker involvement.

An observation or opportunity for improvement is appropriate when the process is functioning but could be strengthened, for example by improving the documentation of control effectiveness ratings, or by formalising the triggers for reassessment.

Writing the Finding

If you raise a nonconformity against Clause 6.1.2.2, write it clearly. State the requirement, describe the objective evidence, and explain how the evidence demonstrates nonconformance. Avoid vague language. Do not write “risk assessments are not adequate”. Write something specific: the risk assessment for confined space entry in the pump room, completed in March 2022 and not reviewed since, does not reflect the installation of new pumping equipment in November 2023, and does not take into account the effectiveness of the existing atmospheric monitoring controls when assigning the residual risk rating.

That kind of finding is specific, evidence based, and gives the organisation something concrete to address in their corrective action. For more guidance on writing findings that hold up to scrutiny, the article on How to Write Audit Findings That Stand Up to Challenge walks through the structure in detail.

Connecting Clause 6.1.2.2 to the Broader Audit

Clause 6.1.2.2 does not sit in isolation. The risk assessment feeds into the selection of controls under Clause 8.1, the hierarchy of controls under Clause 8.1.2, and the setting of OH&S objectives under Clause 6.2. If the risk assessment is weak, you will often find corresponding weaknesses in those downstream clauses. Make a note during your Clause 6.1.2.2 review of any risks that appear to be high but have no corresponding objective, operational control, or management programme. That observation becomes useful when you audit Clauses 6.2 and 8.1.

Similarly, look at the management review inputs. Clause 9.3 requires top management to review information about risks and opportunities. If the risk assessments are outdated or incomplete, the management review cannot have been conducted on accurate information. That is another thread worth pulling.

Building Your Audit Skills in OH&S

Auditing Clause 6.1.2.2 well requires both an understanding of the standard and practical experience with how risk assessment processes work in real workplaces. If you are building your skills in ISO 45001 auditing, Audit Workshop offers internal auditor and lead auditor training specifically for ISO 45001, delivered by Dilawar Laghari, a certified lead auditor with over 14 years of compliance experience and more than 500 external certification audits across Australia, the Middle East, and South Asia. The training is practical, not theoretical, and is built around the kinds of questions and scenarios covered in this article. Whether you are preparing for your first internal audit or working towards lead auditor certification, the courses are available in both live and self paced formats to suit your schedule.