Why Clause 5 Produces So Many Nonconformities
Clause 5 of ISO 45001 is titled Leadership and Worker Participation. It covers top management commitment, the OH&S policy, organisational roles and responsibilities, and the consultation and participation of workers. On paper, these requirements look straightforward. In practice, they generate a disproportionate number of nonconformities at both internal and external audits.
On this page
The reason is simple. Clause 5 is not a documentation exercise. It demands genuine, demonstrable leadership behaviour and real worker involvement. You cannot satisfy it by printing a policy and assigning a title. Auditors are trained to look past documents and into actual practice, and when practice does not match intent, findings follow.
This article walks through the most frequent nonconformities raised against each subclause of Clause 5, explains what auditors are actually looking for, and gives you practical guidance on how to close the gaps before they become formal findings.
Clause 5.1: Leadership and Commitment
Clause 5.1 sets out what top management must personally do to demonstrate commitment to the OH&S management system. The word “demonstrate” is key. ISO 45001 does not allow top management to delegate this responsibility away and consider the obligation met.
Nonconformity 1: Leadership commitment exists on paper only
The most common finding against Clause 5.1 is that top management cannot demonstrate active, ongoing involvement in the OH&S system. This shows up in several ways. Senior leaders are unable to describe the organisation’s significant OH&S risks when asked. They cannot name recent incidents or explain what corrective actions were taken. They have not participated in any OH&S activities, site inspections, or management reviews in recent memory.
Auditors will interview top management directly. If the responses are vague, deferred to the safety manager, or clearly scripted, that is a red flag. The standard requires top management to take accountability for the effectiveness of the system, not just to sign off on it once a year.
What to do: Top management needs to be genuinely involved. That means participating in hazard identification walks, reviewing incident data, attending management reviews and being able to speak to OH&S performance without prompting. Brief your senior leaders before audits, but more importantly, build real engagement into their routine.
Nonconformity 2: OH&S not integrated into business processes
Clause 5.1(e) requires top management to ensure that OH&S requirements are integrated into the organisation’s business processes. Auditors frequently find that OH&S sits in a separate silo, managed by the safety team with no visible connection to procurement, project planning, finance decisions, or operational scheduling.
A common example: a construction company has a detailed OH&S management system, but project timelines are set by the commercial team with no safety input. When tight deadlines create pressure on workers to skip controls, there is no mechanism to flag this. That is an integration failure, and it sits squarely in Clause 5.1.
What to do: Map out where OH&S requirements should feed into other business processes. Procurement should consider contractor safety performance. Project planning should include time for safe work method statements. Finance should budget for safety controls. Document how these integrations work and make sure top management can describe them.
Nonconformity 3: No evidence that top management directs and supports persons to contribute to the system
Clause 5.1(f) requires top management to direct and support persons to contribute to the effectiveness of the OH&S management system. Auditors often find that workers are expected to follow safety procedures but have no mechanism to raise concerns, suggest improvements, or participate in shaping the system. This finding often overlaps with Clause 5.4 but its roots sit in the leadership obligation of 5.1.
Exemplar Global Recognised Training ProviderRTP No. 310970
Clause 5.2: The OH&S Policy
The OH&S policy is one of the most scrutinised documents in any certification audit. Nonconformities here are common and often avoidable.
Nonconformity 4: Policy commitments are generic and not specific to the organisation
ISO 45001 Clause 5.2 requires the policy to include specific commitments: to provide safe and healthy working conditions, to eliminate hazards and reduce OH&S risks, to fulfil legal and other requirements, and to consult and participate workers. Many organisations copy a template policy that ticks these boxes in broad terms but contains nothing specific to their operations, their hazards, or their context.
An auditor reviewing a policy for a mining services contractor that makes no reference to the nature of the work, the environment, or the specific risks involved will question whether the policy reflects the organisation’s actual context as required by Clause 5.2(a).
What to do: Review your policy against your context analysis (Clause 4.1) and your hazard register. The policy should reflect where you work, what you do, and what your significant risks are. It does not need to be exhaustive, but it must be recognisably yours.
Nonconformity 5: Policy not communicated or not available to workers
Clause 5.2 requires the OH&S policy to be available as documented information, communicated within the organisation, and available to interested parties as appropriate. Auditors regularly find that workers on the floor have never seen the policy, cannot describe its intent, and have no idea where to find it.
Posting a laminated copy in the lunchroom does not constitute effective communication. Auditors will ask workers directly. If the responses are blank, that is a finding.
What to do: Include the policy in inductions. Reference it in toolbox talks. Make it accessible digitally and physically. Test worker awareness periodically and document those checks. See our article on how to audit an OH&S policy against Clause 5.2 for a detailed breakdown of what auditors check.
Nonconformity 6: Policy not reviewed or updated to reflect changes
Organisations sometimes set a policy at the time of certification and leave it untouched for years, even as their operations, workforce, or hazard profile changes significantly. Clause 5.2 requires the policy to be appropriate to the nature, scale, and OH&S impacts of the organisation. A policy written for a ten person office that now applies to a fifty person construction operation is no longer fit for purpose.
What to do: Build a policy review trigger into your management of change process and your annual management review. Document when the policy was last reviewed, who reviewed it, and what prompted any changes.
Clause 5.3: Roles, Responsibilities and Authorities
Clause 5.3 requires top management to assign and communicate responsibility and authority for relevant roles within the OH&S management system. Nonconformities here are extremely common.
Nonconformity 7: OH&S responsibilities not assigned below senior management level
Many organisations assign OH&S responsibility to a safety manager and stop there. Clause 5.3 requires that responsibilities are assigned to persons at all relevant levels. Supervisors, team leaders, and workers all have roles in the system. If those roles are not defined, communicated, and understood, the system is fragile.
Auditors will ask supervisors what their OH&S responsibilities are. If the answer is “I just make sure people wear their PPE,” that is a sign that responsibilities have not been properly defined or communicated at that level.
What to do: Include OH&S responsibilities in position descriptions and role-specific inductions. Ensure supervisors can articulate their responsibilities clearly. Document who is responsible for what, and verify understanding through interview during internal audits.
Nonconformity 8: Responsibilities assigned but not communicated
A related but distinct finding is that responsibilities exist in a document somewhere but the people assigned those responsibilities do not know about them. An OH&S responsibility matrix buried in a management system document that no one reads does not satisfy Clause 5.3.
Clause 5.3 specifically requires top management to ensure that responsibilities and authorities are communicated within the organisation. Communication is an active requirement, not a passive one.
What to do: Communicate responsibilities through inductions, team meetings, and performance discussions. Keep records of that communication. During internal audits, verify that assigned persons can describe their responsibilities without needing to look them up. Our article on audit evidence for Clause 5.3 covers the specific evidence auditors look for.
Nonconformity 9: No one assigned to report on OH&S system performance to top management
Clause 5.3(b) requires that someone be assigned responsibility for reporting on the performance of the OH&S management system to top management. This sounds obvious, but auditors regularly find that no one has been formally assigned this role, or that the person assigned has no access to the data needed to do it effectively.
What to do: Formally document who is responsible for reporting OH&S performance to top management, what data they report, and how frequently. Make sure that person has access to incident data, audit results, compliance evaluation outcomes, and objective progress.
Clause 5.4: Consultation and Participation of Workers
Clause 5.4 is where many organisations genuinely struggle. It requires the organisation to establish, implement, and maintain processes for consultation and participation of workers at all applicable levels and functions. This is one of the most distinctive features of ISO 45001 compared to its predecessor OHSAS 18001, and it is frequently misunderstood.
Nonconformity 10: Consultation confused with information sharing
The most common Clause 5.4 finding is that the organisation is informing workers rather than consulting them. Telling workers about a new procedure before it is implemented is not consultation. Consultation means seeking input before decisions are made, considering that input, and being able to demonstrate that the input influenced the outcome.
Auditors will ask workers whether they were involved in developing safe work procedures, risk assessments, or incident investigations. They will ask whether their suggestions have ever changed anything. If the answer is consistently no, or if workers look confused by the question, that is a finding.
What to do: Build genuine consultation into your hazard identification process, your risk assessment process, and your change management process. Document who was consulted, what they said, and how it was considered. If a suggestion was not adopted, document why.
Nonconformity 11: Non-managerial workers excluded from key OH&S processes
Clause 5.4(b) specifically requires organisations to ensure the participation of non-managerial workers in hazard identification and risk assessment, in determining controls, in investigating incidents, and in developing and reviewing OH&S objectives. Many organisations involve supervisors and managers in these activities but exclude the workers who actually do the work.
This is a significant gap. The standard is explicit that non-managerial workers must be involved. An incident investigation conducted entirely by management, without input from the workers present, does not meet this requirement.
What to do: Review each of the processes listed in Clause 5.4(b) and check whether non-managerial workers are genuinely involved. Update your procedures to reflect this requirement. Train supervisors on what participation means in practice. For a deeper look at this area, see our article on consultation and participation of workers under Clause 5.4.
Nonconformity 12: No mechanism for workers to raise OH&S concerns without fear of reprisal
Clause 5.4(e) requires the organisation to remove obstacles or barriers to worker participation, including ensuring that workers can raise concerns without fear of reprisal. Auditors take this seriously. They will ask workers directly whether they feel comfortable raising safety concerns, and whether they have ever experienced or witnessed negative consequences for doing so.
If workers are reluctant to answer, give guarded responses, or describe past incidents where raising a concern led to negative outcomes, that is evidence of a systemic barrier. This finding can escalate quickly if the evidence is strong enough.
What to do: Establish a clear, documented process for raising safety concerns. Communicate it to all workers. Ensure managers understand that discouraging safety reporting is unacceptable. Monitor whether concerns are actually being raised and acted on, and report that data to top management.
Nonconformity 13: Worker participation records are inadequate or absent
Even where consultation and participation genuinely occur, organisations often fail to keep adequate records. Clause 5.4 requires documented information to the extent necessary to have confidence that the processes have been implemented. If there are no records of who was consulted, when, about what, and what the outcome was, an auditor has no basis for concluding the requirement is met.
What to do: Keep records of toolbox talks, safety committee meetings, hazard identification sessions, and risk assessment workshops. Record attendance, topics discussed, suggestions raised, and decisions made. These records are your evidence that Clause 5.4 is functioning.
Exemplar Global Recognised Training ProviderRTP No. 310970Auditing Clause 5 Effectively as an Internal Auditor
If you are running internal audits, Clause 5 deserves dedicated audit time and a structured approach. Do not rely solely on document review. The most important evidence for Clause 5 comes from interviews and observation.
When auditing Clause 5.1, interview at least one member of top management. Ask open questions about their involvement in the OH&S system, the significant risks they are aware of, and how OH&S feeds into business decisions. Their answers will tell you more than any document.
When auditing Clause 5.2, verify that workers can describe the policy intent in their own words. Do not accept a recitation of the policy text. You want to know whether they understand what it means for their work.
When auditing Clause 5.3, interview supervisors and team leaders, not just the safety manager. Ask them what their OH&S responsibilities are and how they were made aware of them.
When auditing Clause 5.4, speak to non-managerial workers away from their supervisors where possible. Ask them whether they have ever been asked for input on a risk assessment or a safe work procedure. Ask whether they know how to raise a safety concern. Their answers will tell you whether Clause 5.4 is real or cosmetic.
For a broader look at how to approach leadership auditing, see our article on auditing leadership commitment under Clause 5.1 of ISO 45001.
Building a Clause 5 Compliance Culture
The nonconformities described in this article share a common root cause: Clause 5 is treated as a compliance exercise rather than a genuine management commitment. Organisations that do well against Clause 5 are not those with the best paperwork. They are those where safety is visibly led from the top, where workers trust the system enough to participate in it, and where responsibilities are understood and owned at every level.
That kind of culture does not happen by accident. It requires deliberate effort, consistent messaging from leadership, and systems that make it easy for workers to engage. The good news is that when Clause 5 is working well, it makes the rest of the management system easier to sustain. Engaged workers identify hazards earlier. Accountable supervisors act on issues faster. Committed leaders allocate resources where they are needed.
If your organisation is preparing for a certification audit or a surveillance audit and Clause 5 is a weak point, start with the fundamentals. Get top management genuinely engaged. Review the policy for specificity and currency. Clarify and communicate responsibilities at every level. And build consultation into your operational processes, not just your documentation.
If you want to build the skills to audit Clause 5 with confidence, Audit Workshop offers ISO 45001 internal auditor and lead auditor training that covers the standard clause by clause, with practical exercises grounded in real audit scenarios. The training is designed for practitioners who need to apply these skills on the job, not just pass an exam.
