Audit Workshop

One of the most common questions we hear from quality and compliance teams is this: how often should internal audits actually happen?

ISO standards require internal audits at planned intervals, but they do not prescribe a fixed frequency. That means the answer depends on your organisation, and getting it wrong in either direction creates problems.

Audit too rarely and you miss nonconformities before they become certification risks. Audit too often without purpose and teams start treating it as a checkbox exercise.

Some factors that should shape your audit frequency include the criticality of the process, past nonconformity trends, results from previous audits, and any significant changes to the business or its context.

A risk based approach to scheduling internal audits is not just good practice. It is what certification bodies expect to see when they assess the effectiveness of your management system.

We have put together a detailed breakdown of how to think through audit frequency, what the standard actually requires, and how to build a programme that holds up under scrutiny.

Read the full article here: https://auditworkshop.com/blog/how-often-should-internal-audits-happen

A well structured audit plan is what separates a smooth internal audit from a chaotic one.

Without a clear plan, auditors end up improvising on the day, scope creep sets in, and auditees are left confused about what is actually being reviewed.

A solid audit plan should cover:

The scope and objectives of the audit
The processes and areas being audited
Who is being interviewed and when
The criteria being used to evaluate conformance
The time allocated to each activity

One thing we see often in training is that new internal auditors underestimate how much time planning actually takes. The audit plan is not a formality. It is the foundation that everything else sits on.

When auditees receive a clear plan in advance, they come prepared. That means better conversations, more useful evidence, and a more efficient audit overall.

We have put together a practical guide on building an audit plan for internal audits, including a ready to use template you can adapt for your own organisation.

Check it out at the link below.

https://auditworkshop.com/blog/audit-plan-for-an-internal-audit-with-template

A well built internal audit checklist is one of the most practical tools an auditor can have.

But most checklists fall short because they are copied from a standard clause by clause without any thought about the actual process being audited.

Here is what makes a checklist genuinely useful.

Start with the process, not the clause. Understand what the process is supposed to achieve, then map your questions to that outcome.

Write questions that require evidence, not just a yes or no answer. Ask how, show me, or walk me through this.

Build in space for observations. The best audit findings often come from something you noticed that was not on the checklist at all.

Keep it focused. A checklist with 80 questions usually means you are auditing paper, not the real system.

We have put together a full guide on how to build internal audit checklists that actually drive improvement rather than just tick boxes.

Read it here: https://auditworkshop.com/blog/how-to-build-an-internal-audit-checklist

A well structured internal audit report does more than document findings. It drives action.

Yet many audit reports end up too vague, too long, or written in a way that leaves management unsure what to actually do next.

Here is what a solid internal audit report should include:

A clear scope and objective so readers know exactly what was audited and why.

Conformances and positive observations, not just nonconformances. Balance matters.

Each nonconformance linked to a specific clause or requirement so there is no ambiguity.

A root cause section that goes beyond the symptom.

Agreed corrective actions with owners and due dates.

A summary that a senior leader can read in two minutes and understand the full picture.

The format matters because even a thorough audit loses credibility when the report is hard to follow.

We put together a practical guide on internal audit report format with a real example you can use as a reference. Worth a read if you are preparing for an audit cycle or building a reporting template for your team.

https://auditworkshop.com/blog/internal-audit-report-format-with-example

Most people learn internal auditing by being thrown into it.

No clear process. No structure. Just a checklist and a hope it goes well.

We put together a practical walkthrough of the entire internal audit process, from planning and scheduling through to conducting interviews, gathering evidence, writing findings, and closing out the audit report.

A few things that make the biggest difference in practice:

Scope your audit tightly before you start. Trying to cover too much in one audit leads to shallow findings and missed nonconformities.

Prepare your questions in advance but stay flexible. The best evidence often comes from follow up questions, not the ones you planned.

Write findings in plain language. If the auditee cannot understand what went wrong and why it matters, the finding is not useful.

The full article walks through each stage with practical guidance you can apply straight away, whether you are doing your first internal audit or your fiftieth.

Read it here: https://auditworkshop.com/blog/how-to-do-an-internal-audit-from-start-to-finish

Not all internal audit courses are the same, and picking the wrong one can cost you time, money, and credibility.

Here are the things that actually matter when choosing a course.

First, check whether the training provider is recognised by a credible body. Exemplar Global recognition means the course meets internationally benchmarked standards and your certificate carries weight with certification bodies.

Second, look at who is delivering the training. Trainer background matters. Someone with real audit experience across multiple industries will teach you how audits actually run, not just how they look on paper.

Third, consider the format. Live online training gives you interaction and the ability to ask questions in real time. Self paced works if you need flexibility. The best providers offer both.

Fourth, check what you walk away with. A Certificate of Attainment and a digital badge you can add to your LinkedIn profile shows employers and clients that your skills have been independently verified.

We have put together a full guide on how to evaluate your options before you commit.

Read it here: https://auditworkshop.com/blog/internal-audit-training-how-to-choose-a-course

If you work in health and safety and are looking to build ISO 45001 auditing skills, the options for online training have expanded significantly in recent years.

But not all courses are the same. Some give you a certificate for completing a few videos. Others prepare you to actually conduct audits, write findings, and handle auditee pushback in the real world.

The key differences to look for when comparing ISO 45001 online training options are:

Whether the course is recognised by a credentialing body like Exemplar Global
Whether it covers audit planning, evidence gathering, and nonconformance writing in depth
Whether you get access to an experienced auditor, not just pre-recorded slides

Foundation, Internal Auditor, and Lead Auditor levels each serve a different purpose depending on where you are in your career.

We put together a detailed breakdown of what each level covers, what to look for in a provider, and how to choose the right course for your goals.

Worth a read if you are weighing up your options.

https://auditworkshop.com/blog/iso-45001-training-online-options

ISO 45001 audits reveal the same gaps time and time again.

After hundreds of certification audits across multiple industries, certain nonconformities keep appearing regardless of company size or sector.

The most common ones tend to sit in areas like hazard identification, competency records, emergency preparedness, and management review. These are not obscure clauses. They are core requirements that organisations often treat as tick boxes rather than living processes.

What makes these nonconformities so persistent is not a lack of awareness. It is the gap between having a procedure and actually following it consistently.

We have put together a detailed breakdown of the most common ISO 45001 nonconformities found during external audits, with practical context on why they occur and what auditors look for.

If you are preparing for certification, conducting internal audits, or supporting a client through surveillance, this is worth reading before your next audit.

Check out the full article at the link below.

https://auditworkshop.com/blog/common-iso-45001-nonconformities

An ISO 45001 internal audit is only as good as the preparation behind it.

Without a structured checklist, it is easy to miss critical OHS requirements, skip hazard identification controls, or leave clause coverage gaps that show up later in a certification audit.

A solid ISO 45001 internal audit checklist should cover:

Context of the organisation and worker consultation
Leadership commitment and OHS policy
Hazard identification and risk assessment processes
Operational controls and emergency preparedness
Performance monitoring and incident investigation
Management review outputs

The checklist is not just a tick and flick exercise. It is a tool for having the right conversations on the floor, with workers, supervisors, and management.

We have put together a practical ISO 45001 internal audit checklist that maps directly to the standard clauses and helps you ask the questions that actually matter.

Read the full article and access the checklist here:
https://auditworkshop.com/blog/iso-45001-internal-audit-checklist

A risk matrix is one of the most practical tools in any OHS program. But a lot of teams either build one that is too complex to use, or too simple to be meaningful.

The goal is a matrix that actually helps workers and managers make decisions in the field, not just satisfy an auditor.

Here is what makes a risk matrix work in practice:

Likelihood and consequence ratings need to reflect your actual workplace, not a generic template copied from the internet.

Your risk levels need to link directly to actions. If a risk is rated high, what must happen next? Who is responsible? By when?

The matrix should be reviewed when incidents occur, when processes change, and at regular intervals. A risk matrix that never changes is usually a sign it is not being used.

We put together a practical guide on how to build and use an OHS risk matrix, including what to include, common mistakes to avoid, and how it connects to ISO 45001 requirements.

Worth a read if you are working in WHS, HSE, or preparing for an ISO 45001 audit.

https://auditworkshop.com/blog/ohs-risk-matrix-how-to-build-and-use-one