Guide · ISO 45001 · 5 September 2026

ISO 45001 Audit Preparation: the 90-Day Plan That Passes

The ISO 45001 audit is won in the preparation, not in the week before the auditor arrives. The 90-day plan is the sequence: the gap analysis, the document, the implementation, the internal audit, the management review, and the mock audit. This guide is the preparation in working form — the 90 days, the task by the week, the evidence by the clause, and the mock audit that finds the gap before the auditor does.

ISO 45001 Audit Preparation: the 90-Day Plan That Passes — HSE guide
The bottom line: The ISO 45001 audit is won in the 90-day preparation: the gap analysis (day 1-15, the clause by clause), the document (day 16-45, the clause by clause), the implementation (day 46-60, the practice on the floor), the internal audit (day 61-75, the check before the external), the management review and the mock audit (day 76-90, the gap-finder). The audit is won before the auditor arrives.

The 90 days: the sequence

The preparation is the 90 days, and the 90 days is the sequence. Day 1 to 15 — the gap analysis: the clause by clause, the current state, the gap. The gap is the plan. Day 16 to 45 — the document: the manual, the policy, the risk register, the legal register, the procedure, the objective. Day 46 to 60 — the implementation: the risk assessment on the floor, the permit, the training, the near-miss log.

Day 61 to 75 — the internal audit: the clause 9.2, the check before the external one. Day 76 to 90 — the management review and the mock audit: the clause 9.3, and the stage 1 and the stage 2 simulated before the real one. The sequence is the plan — and the plan is the pass.

The gap analysis: the clause by clause

The gap analysis is the day 1 to 15 — the current state against the standard, the clause by clause. The clause 4 (the context): the stakeholder identified, the requirement known, the scope defined. The clause 5 (the leadership): the policy stated, the role accountable, the top management visible. The clause 6 (the planning): the hazard assessed, the legal register current, the objective measurable.

The clause 7 (the support): the competence recorded, the awareness done, the documented information controlled. The clause 8 (the operation): the control in place, the hierarchy applied, the emergency plan tested. The clause 9 (the performance): the monitoring running, the internal audit programmed, the management review held. The clause 10 (the improvement): the nonconformity closed, the corrective action effective. The gap is the not-the-system — and the not-the-system is the plan.

The documents: the clause by clause

The document is the day 16 to 45 — the clause by clause, the document each clause needs. The manual: the scope, the system, the clause map. The policy: the commitment, signed by the top management. The risk register: the clause 6.1 — the hazard, the likelihood, the consequence, the control, the ALARP. The legal register: the clause 6.1.3 — the compliance obligation, current.

The procedure: the process, the who, the when. The objective: the clause 6.2 — the measurable, the date. The training matrix: the clause 7.2 — the competence, the record. The emergency plan: the clause 8.2 — the preparedness, the drill. The internal audit report: the clause 9.2. The management review minute: the clause 9.3. The nonconformity record: the clause 10.2. The document is the clause — and the clause is the evidence.

The internal audit: before the external

The internal audit is the day 61 to 75 — the clause 9.2. The programme is the clause by clause, the site by the site. The auditor has to be independent — not the person who owns the area audited. The finding is the conformance, the minor, the major, and the observation. The corrective action is the finding, the root cause, the action, and the verification that the action worked.

The internal audit is the check before the external one — the finding that is closed before the certification body arrives is the finding that never becomes the nonconformity on the certificate.

The mock audit: the gap-finder

The mock audit is the day 76 to 90 — the stage 1 and the stage 2 before the real one. The mock simulates the external auditor: the mock stage 1 is the document review, and the mock stage 2 is the on-site — the walk, the interview, the evidence.

The mock finds the gap that the internal audit missed — the document that is out of date, the worker who does not know the policy, the permit that is not the signed one. The gap found in the mock is the gap fixed before the auditor arrives — and that is the pass.

Practical use of iso 45001 audit preparation: the 90-day plan that passes in the workplace

How to Prepare for an ISO 45001 Audit (without Losing Weeks)

The preparation that does not lose weeks runs on three phases and a team of two or three, not twenty. Weeks 1 to 4: the gap analysis against the clauses, and the document set that closes the gap — the policy, the risk assessment, the objectives, the procedure, the emergency plan. Weeks 5 to 8: the internal audit on the programme, the findings closed with the owner and the date, and the management review that signs the system. Weeks 9 to 12: the mock audit on the stage 2 pattern — the document review, the interview, the walk — and the readiness sign-off. The team of two or three owns the paper; the floor owns the answer. The 90-day plan on this page is the sequence, the deliverable, and the owner for each week.

Need the sign-off, not just the guide?

The guide is the preparation; the sign-off is the professional. For the ISO 45001 implementation and audits, the RIDDOR and CDM work, the statutory assessments and the training that comes with them, ask Muhammad Umer — 8+ years across Iraq, KSA and Pakistan, and the programme runs through umer-hse.pro. One message gets the written scope.

Common questions

ISO 45001 Audit Preparation — answered

How do you prepare for an ISO 45001 audit?

The 90-day plan: the gap analysis (day 1-15, the clause by clause), the document (day 16-45, the manual, the policy, the risk register, the legal register, the procedure), the implementation (day 46-60, the risk assessment, the permit, the training, the near-miss log), the internal audit (day 61-75, the clause 9.2), and the management review and the mock audit (day 76-90, the clause 9.3 and the gap-finder).

What is a gap analysis for ISO 45001?

The clause by clause, the current state against the standard: the clause 4 (the context), the clause 5 (the leadership), the clause 6 (the planning), the clause 7 (the support), the clause 8 (the operation), the clause 9 (the performance), the clause 10 (the improvement). The gap is the plan — the work that has to be done before the audit. The gap analysis is the day 1 to 15 of the 90-day plan.

How long does ISO 45001 audit preparation take?

Typically 90 days: the gap analysis (15 days), the document (30 days), the implementation (15 days), the internal audit (15 days), and the management review and the mock (15 days). The site that already runs a working system is the 60 days; the site that starts from zero is the 90 to 120.

What is the internal audit in ISO 45001?

The clause 9.2: the programme, the independent auditor, the finding (the conformance, the minor, the major, the observation), and the corrective action (the root cause, the action, the verification). The internal audit is the check before the external one — the finding closed before the certification body arrives is the finding that never becomes the nonconformity.

What is a mock audit?

The stage 1 and the stage 2, simulated before the real one: the external auditor, the document review, the on-site. The mock finds the gap that the internal audit missed. The mock is the day 76 to 90 of the 90-day plan — the gap-finder that is the pass.

What documents does the ISO 45001 auditor ask for?

The manual (the scope, the system), the policy (the commitment, the signed), the risk register (the clause 6.1), the legal register (the clause 6.1.3), the procedure (the process), the objective (the clause 6.2, the measurable, the date), the training matrix (the clause 7.2), the emergency plan (the clause 8.2), the internal audit report (the clause 9.2), the management review minute (the clause 9.3), the nonconformity record (the clause 10.2).

Safety disclaimer

The guides on this site are practical guidance, built to the UK baseline with the US equivalents named in the text. They do not replace a competent person assessment for high-risk work, a statutory assessment, or the advice of your insurer. Where a duty has legal force — the RIDDOR report, the CDM plan, the ISO 45001 system — the responsible person or the responsible owner carries it. Read the guide as the preparation, and take the sign-off from the competent person.