ISO 45001 in Energy and Utilities: The Most Common Audit Failures

The Seven Most Common ISO 45001 Audit Findings in Energy

1. Contractor H&S management inadequate. ISO 45001 Clause 8.1.4.2 requires the organisation to coordinate with contractors to ensure they understand site hazards and implement adequate controls. Contractor management is consistently the highest-finding category: pre-qualification inadequate, induction insufficient, on-site supervision absent, and contractor near-miss incidents not captured in the main incident reporting system.
2. Permit-to-work not consistently applied. Permit-to-work systems for high-hazard work — hot work, confined space entry, electrical isolation, working at height — must be implemented consistently and must cover all high-hazard work including contractor activities. Auditors consistently find permit-to-work breaches, expired permits not renewed, and high-hazard work conducted without permits.
3. Emergency response plans not tested for site-specific scenarios. Generic emergency response plans that do not address the specific major incident scenarios relevant to the site — electrical fire, chemical release, confined space rescue — are a consistent finding. Plans must be tested through drills simulating site-specific emergency scenarios, not generic evacuation drills.
4. OHS risk assessment not updated for operational changes. Risk assessments conducted during initial certification but not updated as the site's operations change — new equipment, changed work practices, new contractors, seasonal risks — do not reflect the current risk profile. ISO 45001 requires dynamic risk assessment, not a point-in-time exercise.
5. Leading indicators not used in OHS performance monitoring. Energy organisations frequently monitor lagging indicators (injury rates, lost time) without monitoring leading indicators (near-miss rates, permit-to-work compliance rates, safety observation rates) that provide advance warning of deteriorating safety performance.
6. Worker participation not genuine. ISO 45001 Clause 5.4 requires worker consultation and participation. Auditors assess whether this is genuine — do workers know how to raise safety concerns, are concerns recorded and responded to, and is there evidence that worker input has influenced OHS decisions?
7. Management review does not address OHS improvement decisions. The management review must generate OHS improvement decisions — not just acknowledge performance data. Auditors assess whether the review has generated specific commitments to OHS improvement and whether previous review commitments have been fulfilled.

Contractor Management — The Highest-Risk Gap

In energy sector ISO 45001 audits, contractor H&S management is the finding category that most directly correlates with actual workplace incidents. The gap between what the organisation's H&S management system requires of contractors and what contractors are actually delivering on site is where most energy sector fatalities and serious injuries originate.

Effective contractor H&S management in energy requires four elements: risk-proportionate pre-qualification that specifically assesses H&S management capability (not just commercial qualifications), site induction that covers site-specific hazards and emergency procedures for the specific work being performed, on-site supervision proportionate to the risk level of the work, and integration of contractor near-miss incidents and unsafe act observations into the site's OHS performance monitoring.