ISO 45001 Internal Audit Programme for Multi-Site Groups

In a single factory, the internal audit is a known event: one team, one checklist, one report. In a group with thirty, eighty or two hundred sites in several countries, the internal audit programme becomes a management system of its own. Who audits which site, how often, against which checklist, and what happens to the findings? If those questions are answered differently in every country, the group cannot tell whether its ISO 45001 system really works, and neither can the certification body.

This guide is for group and regional EHS directors, compliance leads and internal audit teams. It sets out what ISO 45001 requires, what multi-site certification adds, and a practical way to run one internal audit programme across many sites. It is general information, not legal advice; your certification body applies the details.

Why internal audits drift in a group

Every site audits itself. The site HSE officer audits the procedures they wrote. The audit is completed on time, but it is not independent.
Different checklists, different scores. One country uses a 40-question checklist, another uses 200. "90% compliant" means something different in each place.
The calendar decides, not the risk. Every site gets one audit a year, whether it is a low-risk office or a plant with hot work, confined spaces and many contractors.
Day shift only. Audits happen when managers are present. Night shifts, weekend maintenance and contractor work are rarely seen.
Findings stay local. A gap found in one plant is closed there, while the same gap sits unnoticed in ten sister plants.

What ISO 45001 clause 9.2 requires

Clause 9.2.1 asks the organization to conduct internal audits at planned intervals to find out whether the OH&S management system conforms to its own requirements, including its OH&S policy and objectives, and to the requirements of ISO 45001, and whether it is effectively implemented and maintained. Clause 9.2.2 then sets out the audit programme. In plain terms:

Requirement (9.2.2)	What it means for a group
Plan, establish, implement and maintain an audit programme, including frequency, methods, responsibilities, consultation, planning requirements and reporting	One written group programme, not a collection of site calendars
Take into account the importance of the processes concerned and the results of previous audits	Frequency and depth follow risk and history, not a fixed annual slot
Define the audit criteria and scope for each audit	Each audit states which clauses, processes, areas and shifts it covers
Select auditors and conduct audits to ensure objectivity and impartiality	People do not audit their own work; cross-site auditors are the usual answer
Report results to relevant managers, and relevant results to workers and, where they exist, workers' representatives and other relevant interested parties	Reporting goes to the floor and the safety committee, not only to management
Take action to address nonconformities and continually improve OH&S performance	Findings feed the group's corrective action process (clause 10)
Retain documented information as evidence of the programme and the results	Plans, reports, findings and closures must be findable for every site (see ISO document control for multi-site groups)

Note the word consultation in the programme itself. ISO 45001 gives non-managerial workers a role in the system, and that includes how audits are planned and how their results are shared.

Multi-site certification raises the bar

If your group holds, or wants, one ISO 45001 certificate for many sites, the internal audit programme carries more weight. Under IAF MD 1:2023 (application date 18 October 2023), one of the eligibility conditions is that all sites are included in the organization's internal audit programme, not only the sites the certification body will sample. Certification bodies spell out what that means in practice: GUT CERT's multi-site instruction sheet, for example, states that before the initial certification audit the full internal audit must have been completed at all sites and the management review carried out.

The internal audit programme also shapes the external audit. The certification body visits only a sample of sites, and it looks at how well the central function knows and controls every site. Our guide to ISO 45001 multi-site audit and certification explains the sampling rules, the role of the central function and what happens when a nonconformity at one site points to a system weakness.

Designing a risk-based programme

ISO 19011 gives guidance (not requirements) on managing an audit programme, including a risk-based approach: identify what could stop the programme from meeting its objectives, such as auditors without enough competence, too little audit time or locations that are never examined. ISO published the fourth edition, ISO 19011:2026, on 27 May 2026; it replaces the 2018 edition, keeps the seven auditing principles and expands the guidance on remote auditing. A practical design for a group has four parts:

1. Tier the sites by risk. Group sites by the hazards they actually carry (for example process hazards, hot work, confined spaces, heavy vehicles, contractor volume) and by their record: open findings, serious incidents and the results of the last audit. An illustrative model, to adapt to your own risk profile:

Tier	Typical sites	Illustrative full-audit cycle	Extra focus
High	Process plants, heavy manufacturing, sites with a recent serious incident or many open findings	Every 6 to 12 months, plus follow-up visits	Operational controls, permits, contractors, emergency preparedness
Medium	Light manufacturing, large warehouses and logistics hubs	Every 12 months	Vehicles and people, training, near-miss reporting
Low	Offices, small sales sites	Every 12 to 24 months, possibly remote	Ergonomics, emergency arrangements, worker consultation

2. One clause map, local scenarios. Use one group checklist organized by ISO 45001 clause, with the same scoring and the same finding categories everywhere. Sites can add questions for local hazards and local law, but they cannot remove the group core. Our playbook on standardizing HSE reporting across countries covers how to agree common definitions.

3. Cover the whole clause set over the cycle. Not every audit has to cover every clause, but over the audit cycle each site's programme should cover the full system: context and leadership, worker participation, hazard identification, legal requirements, competence, operational control, emergency preparedness, monitoring, incident investigation and improvement.

4. Audit the shifts, not just the office. Write shift coverage into the scope: at least part of each high-tier audit should take place on a night or weekend shift, and should include contractor work and worker interviews on the floor.

Auditors: objectivity across sites

Clause 9.2.2 asks for objectivity and impartiality; ISO 19011 adds guidance on auditor competence and its evaluation. In a group, the usual answer is a cross-site auditor pool:

Trained HSE staff audit other sites, ideally in another business unit or country, never their own.
Each audit team pairs an experienced lead auditor with a newer auditor, which builds capacity.
Technical experts (for example process safety or electrical) join audits of high-tier sites.
Competence is recorded: training, audits led, observed audits and feedback.
Worker representatives can be consulted on the programme and receive the results that concern them.

A cross-site pool also spreads good practice: auditors bring ideas home from the sites they visit.

On-site, remote or both

Remote audit methods help a group with sites in many countries, especially for document review, interviews with central functions and follow-up of closed findings. ISO 19011:2026 expands its guidance on remote auditing methods and recognizes virtual locations in the audit scope, and says the audit programme should consider digital tools together with information security and confidentiality. Certification bodies are cautious: DQS notes that not every situation can be adequately assessed remotely, that the technology must be tested in advance and that confidentiality of electronic information must be agreed. A sensible rule for internal audits: observe operational controls in person, and use remote methods for documents, records and follow-up.

From findings to group learning

An internal audit only earns its cost when its findings change something. Three practices make that happen at group level:

One finding scale. Grade findings the same way everywhere (for example major nonconformity, minor nonconformity, observation), with deadlines tied to the grade.
Every finding becomes a tracked action. Each finding has an owner, a due date and a check that the action worked, through the same corrective action process used for incidents. Our guide to incident investigation and CAPA at group level sets out that process.
Ask "where else?" When a finding points to a weakness in a group procedure or standard, check sister sites and fix the procedure centrally, not only the site where it was found.

Report results in a form people use: a short summary for site management, a group roll-up for the management review (clause 9.3), and relevant results shared with workers and the safety committee.

Measuring the audit programme

The programme itself needs monitoring. A small set of measures, reviewed by the central function and in the management review:

Programme completion: audits done versus planned, by tier and region.
Coverage: clauses and shifts covered per site over the cycle.
Open and overdue findings by grade, site and age.
Repeat findings: the same finding at the same site in consecutive audits, a sign that actions are not effective.
Systemic findings: findings that show up at several sites, pointing to a group-level fix.
Auditor capacity: qualified auditors per region against the planned workload.

These sit well next to the safety indicators in our guide to leading and lagging safety KPIs.

12-point checklist

#	Item	Done
1	One written group audit programme covering frequency, methods, responsibilities, consultation, planning and reporting (9.2.2)	☐
2	Every site in the programme, including small and remote sites	☐
3	Sites tiered by risk and audit history; frequency set per tier	☐
4	One clause-based checklist and scoring method, with local additions only	☐
5	Criteria and scope defined for each audit, including shifts and contractors	☐
6	Cross-site auditor pool; nobody audits their own work	☐
7	Auditor competence defined, recorded and evaluated	☐
8	Rules for when remote methods are used and how information is protected	☐
9	One finding scale; every finding tracked as an action to verified closure	☐
10	"Where else?" review for findings that point to a group weakness	☐
11	Results reported to managers, workers and representatives; group roll-up in the management review	☐
12	For multi-site certification: full internal audit cycle at all sites before the initial certification audit	☐

How AccelSafety helps

AccelSafety, our enterprise HSE software, keeps the audit programme and its evidence in one place. Every site sits in one organizational hierarchy, from group to region, country, cluster and site, so the central function sees which sites were audited and what was found. Audits and inspections run on checklists with photos, captured on a phone at the point of work, and HSE work is grouped by ISO 45001 clause, so thin evidence shows up early. Findings become actions with owners and due dates in the actions and CAPA module, and dashboards drill back to the auditable source records with their history. Access is scoped to each user's part of the hierarchy and enforced on the server, so cross-site auditors see what they need and no more. See how it maps to the standard on our ISO 45001 software page, or book a demo to walk through your own programme.

General information, not legal advice. Check the current text of ISO 45001, IAF MD 1 and your certification body's rules for your sites.

ISO 45001 internal audits across many sites: a group audit programme that works