Clause 9.2.2: Internal audit programme
The organization plans, sets up, runs and keeps an audit programme, covering how often audits happen, the methods used, who is responsible, consultation, planning requirements and reporting, with regard to how important the processes involved are and what earlier audits found.
What clause 9.2.2 asks
The organization plans, sets up, runs and keeps an audit programme, covering how often audits happen, the methods used, who is responsible, consultation, planning requirements and reporting, with regard to how important the processes involved are and what earlier audits found. It sets the criteria and scope of every audit; chooses auditors and runs audits so that they are objective and impartial; makes sure results reach the relevant managers, workers and their representatives, and other relevant interested parties; acts on nonconformities and to keep improving its OH&S performance; and keeps documented information as evidence.
The programme allocates audit attention by risk and by what earlier audits found. Auditor independence and reporting to workers are part of the requirement, not good practice.
Put remote groups in the programme. A programme built around sites will miss a workforce that is not on a site. The public scope's mobile roles and client sites, and the consultation release's all-sizes framing, mean the programme has to include remote and hybrid groups by risk, not only by address. The auditor also needs remote audit methods that do not depend on a site visit.
Basis: BSI Standards Development, BSI. For clause 9.2.2, the public record is a draft guideline and does not state a requirement in terms that this site can quote. The clause 9.2.2 overlay is our reading of the public scope and the named summaries, not the draft text.
Evidence for clause 9.2.2
An auditor will check that the riskiest process got the most attention and that results reached workers.
- Audit programme Audit programme showing frequency weighted by risk and previous results
- Audit programme Audit plans with criteria and scope
- Audit programme Auditor independence and competence records
- Audit programme Evidence results reported to workers and representatives
- Audit programme Corrective actions from audit findings
Where clause 9.2.2 commonly fails
- Same programme every year regardless of risk or past findings
- Results reported to management only, never to workers
- Auditors audit their own areas
What to do about clause 9.2.2 before the guidance lands
Rebuild the audit programme from the risk register and include remote and hybrid groups. Record the method for a remote audit, the auditor's independence and the consultation of remote workers. Report the results to the workers who were audited.
For clause 9.2.2, do the work that will be right under either instrument. The current requirement for clause 9.2.2 is ISO 45001:2018, and the certificate, if you hold one, is issued against it. The clause 9.2.2 remote working preparation is an extension of the existing duty to a group of workers the system already covers, not a new system and not a reason to rebuild around a draft.
Read across from clause 9.2.2
Open the full index. The public record behind clause 9.2.2 shows the scope and the themes.
Source for clause 9.2.2: ISO 45001:2018, clause 9.2.2, retrieved 20 October 2026, record at the standards library. The clause 9.2.2 remote overlay rests on the public 45008 record named above. The clause 9.2.2 requirement, evidence and gaps are written from our clause record. Every source.