Clause 9.2.2: Internal audit programme
The organization plans, sets up, runs and keeps an audit programme, covering how often audits happen, the methods used, who is responsible, consultation, planning requirements and reporting, with regard to how important the processes involved are and what earlier audits found.
What clause 9.2.2 asks
The organization plans, sets up, runs and keeps an audit programme, covering how often audits happen, the methods used, who is responsible, consultation, planning requirements and reporting, with regard to how important the processes involved are and what earlier audits found. It sets the criteria and scope of every audit; chooses auditors and runs audits so that they are objective and impartial; makes sure results reach the relevant managers, workers and their representatives, and other relevant interested parties; acts on nonconformities and to keep improving its OH&S performance; and keeps documented information as evidence.
The programme allocates audit attention by risk and by what earlier audits found. Auditor independence and reporting to workers are part of the requirement, not good practice.
Draft 9.2.2 Internal audit programme, from clause 9.2.2. The public draft contents keep 9.2.2. No substantive change is described in the summaries held.
Evidence for clause 9.2.2
An auditor will check that the riskiest process got the most attention and that results reached workers.
- Audit programmeAudit programme showing frequency weighted by risk and previous results
- Audit programmeAudit plans with criteria and scope
- Audit programmeAuditor independence and competence records
- Audit programmeEvidence results reported to workers and representatives
- Audit programmeCorrective actions from audit findings
Where clause 9.2.2 commonly fails
- Same programme every year regardless of risk or past findings
- Results reported to management only, never to workers
- Auditors audit their own areas
What to do about clause 9.2.2 before the revision
Rebuild the programme from the risk register and the last findings. Record auditor independence. Report results to workers and their representatives. Track closure and effectiveness of the corrective actions.
What the record shows for clause 9.2.2
An auditor working on clause 9.2.2 will start with Audit programme showing frequency weighted by risk and previous results. The failure this record sees most often is Same programme every year regardless of risk or past findings. Both are carried into the kit as row 36, with an owner field and a dated action.
Read across from clause 9.2.2
Read the next clause in the group, or open the full index. The revision map shows the draft structure.
Source for clause 9.2.2: ISO 45001:2018, clause 9.2.2, retrieved 18 October 2026. The draft note rests on the public DIS contents and the two named summaries; the requirement, evidence and gaps are written from the held clause record. Every source.