ISO Audit Evidence by Clause: Prepare Once, Pass Audits

Most audit stress has the same cause: the work was done, but the proof is scattered. The toolbox talk happened, yet the attendance sheet is in a site office drawer. The corrective action was closed, yet nobody can show that it worked. Auditors do not certify intentions; they certify what they can see and verify.

This guide shows how to organize evidence by clause once, so the same records serve your internal audits, your certification body's stage 2, every surveillance visit and your ESG reporting. It uses ISO 45001 as the main example and shows where ISO 14001 and ISO 9001 share the same clauses. It is general information, not legal or certification advice: your certification body decides what it samples.

What auditors mean by evidence

ISO 19011, the guideline for auditing management systems, defines audit evidence as records, statements of fact or other information that are relevant to the audit criteria and verifiable (wording of the 2018 edition; the fourth edition, ISO 19011:2026, replaced it in May 2026). Two words in that definition matter most:

Relevant: the record must answer a specific requirement, for example clause 7.2 on competence. A thick folder that answers no clause is not evidence.
Verifiable: the auditor must be able to check it. A record with a date, an author, a site and a history can be verified; an undated spreadsheet edited by many people is hard to trust.

Evidence comes in three forms: documents you maintain (policy, scope, procedures), records you retain (training, inspections, incidents, audit results), and what auditors see and hear on the floor through observation and interviews. Software can organize the first two. The third depends on the work actually being done, which is why records should be created where the work happens, not typed up the week before the audit.

When evidence is checked

Accredited certification follows a three-year cycle. Bureau Veritas, for example, describes it as follows:

Stage 1 checks whether you are ready: your understanding of the standard, the scope of the system and your internal audit process.
Stage 2 reviews the management system in detail and reports nonconformities, observations and opportunities for improvement.
Surveillance audits take place at least once per calendar year (except in recertification years), the first within 12 months of the initial certification decision.
Recertification is a full reassessment every three years, completed before the certificate expires.

So evidence is not a one-off project. Each visit samples recent records, and auditors look for continuity: are this year's inspections, training and actions as complete as last year's? Our guide to ISO 45001 multi-site certification explains how sampling works when you have many sites.

Evidence by clause, 4 to 10

ISO 45001, ISO 14001 and ISO 9001 share the same ten-clause Harmonized Structure: scope, normative references, terms, context of the organization (4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). The table lists the documented information ISO 45001:2018 explicitly requires, as summarized in Advisera's mandatory documentation checklist, and where it should live.

Clause	What the auditor asks for	Where it should live
4.1, 4.2	Issues and interested parties, including whether climate change is relevant (2024 amendment)	Context register, reviewed at management review
4.3	Scope of the OH&S management system	Controlled document, one per certificate
5.2, 5.3	OH&S policy; roles, responsibilities and authorities	Controlled documents, translated and signed off
5.4	Consultation and participation of workers	Safety committee minutes, toolbox talks, hazard reports
6.1.1, 6.1.2	Process and method for risks and opportunities; the risks and actions	Risk assessments with controls and owners
6.1.3	Legal and other requirements	Legal register per country and site
6.2.2	OH&S objectives and plans to achieve them	Objectives with owners, targets and progress
7.2	Evidence of competence	Training records linked to roles, with expiry dates
7.4	Evidence of communications	Notices, briefings, attendance
7.5	Control of documents, including external documents	Document control with versions and approvals
8.1, 8.2	Operational controls; emergency preparedness procedure and plans	Permits, contractor and visitor records, drill reports
9.1	Monitoring and measurement results; calibration of equipment; compliance evaluation	Inspections, KPIs, equipment and compliance records
9.2	Internal audit programme and results	Audit plans, checklists, findings
9.3	Management review results	Minutes with decisions and actions
10.2, 10.3	Incidents and nonconformities, actions taken, effectiveness; continual improvement	Incident investigations, CAPA with verification

Clause 10.2 is where many audits find gaps. A closed action is not enough: the standard asks for the results of corrective action, including its effectiveness. Build a verification step into every action, with a date and a person who checks that the fix worked.

Prepare once for several standards

Because the structure is shared, a large part of the evidence serves ISO 45001, ISO 14001 and ISO 9001 at the same time: the context register, interested parties, legal register, competence, communication, document control, internal audit, management review and corrective action. Groups that keep separate folders per standard collect the same records two or three times and still end up with gaps.

A better model is one record, tagged to every clause it supports. A management review held once can cover the agenda items of all three standards. One internal audit programme can audit several standards at a site in one visit, with findings tagged by standard. One training record proves competence for safety and environmental roles alike. Prepare it once, and every audit draws on the same evidence. This is the idea behind ISO and ESG software that is easy to prepare, easy to report and easy to audit.

What the 2026 revisions change

Climate change (2024). An amendment added to clause 4.1 of all Annex SL standards that the organization shall determine whether climate change is a relevant issue, with a note in 4.2 that interested parties can have climate-related requirements. SGS notes that if you decide it is not relevant, auditors will assess how you reached that decision. Keep the reasoning in your context register.
ISO 14001:2026 (published April 2026) keeps the Harmonized Structure. The CQI lists a new clause 6.1.4 on risks and opportunities, a new change management clause 6.3, management review reorganized into defined sub-clauses, former 10.3 merged into 10.1 and 10.2, documented audit programmes, and stronger lifecycle and supply chain focus. A three-year transition applies to certified organizations.
ISO 9001:2026 was published on 16 September 2026 and, according to NSF, aligns with the Harmonized Structure, with a transition of about three years for ISO 9001:2015 certificates.

For evidence this means: re-tag records to the new clause numbers, add change management and climate reasoning to your evidence map, and keep the 2015 mapping until each certificate has moved. Our guide to ISO document control for multi-site groups covers the document side of the transition.

Evidence across many sites

In a group, the auditor samples sites, so every site must be able to show the same kind of evidence in the same place. Three rules help:

One evidence map for the group. The clause-to-record table above is set once at group level; sites fill it, they do not redesign it.
Records created at the source. A supervisor reports a near miss from a phone with a photo; the record carries the site, date and author from the start.
Group visibility without retyping. Group HSE can see, before the auditor does, which sites have overdue actions, missing drills or expired training.

Run your multi-site internal audit programme on the same map, and internal findings and certification findings will speak the same language.

12-point evidence checklist

Each requirement has a named record type and a place where it lives.
Each record shows date, site, author and change history.
Scope, policy and roles are current, approved and translated.
The context register records whether climate change is relevant, and why.
The legal register is reviewed per country and site, with compliance evaluation results.
Risk assessments use one method across sites and name control owners.
Training records are linked to roles, with expiry dates tracked.
Inspections and drills are on schedule, with findings turned into actions.
Every corrective action has an owner, a due date and an effectiveness check.
The internal audit programme covers every clause and every site in the cycle.
Management review minutes show decisions, owners and follow-up.
Records shared by several standards are kept once and tagged to each clause.

Frequently asked questions

What is audit evidence in ISO audits?

ISO 19011 defines audit evidence as records, statements of fact or other information that are relevant to the audit criteria and verifiable. In practice it is the documents, records, observations and interviews that show a requirement is met.

Which records does ISO 45001 require?

ISO 45001:2018 requires documented information such as the scope, the OH&S policy, roles and responsibilities, risks and opportunities, legal requirements, objectives, evidence of competence and communication, emergency plans, monitoring and compliance results, the internal audit programme and results, management review results, and incidents, nonconformities and corrective actions.

How often do certification auditors check evidence?

Within a three-year cycle: stage 1 and stage 2 at initial certification, surveillance audits at least once per calendar year, and a full recertification audit every three years.

Can one set of records serve ISO 45001, 14001 and 9001?

Yes, for the many requirements that share the Harmonized Structure, such as context, legal requirements, competence, document control, internal audit, management review and corrective action. Keep each record once and tag it to every clause it supports.

Does software make us ready for an ISO audit?

Software does not certify anyone; an accredited certification body does. What software can do is keep records complete, dated and findable by clause, and show gaps early, so the audit checks your work rather than your filing.

How AccelSafety helps

AccelSafety lets teams work by task menu or by ISO 45001 clause menu (Plan-Do-Check-Act), with more than 50 certification tools for ISO 45001, 14001, 9001, 50001, 22000 and 22301, and requirements the standards share handled once. Incidents and investigations, hazards and near misses, risk assessments, actions and CAPA, audits and inspections with photos, training and competence, emergency drills, the safety committee and the legal register all sit in one system. Every change is in a full audit trail, every dashboard figure drills back to its source record, and access is scoped to each user's part of the group hierarchy.

Your last two years of files are migrated within 7 days of installation, guaranteed, so the evidence history is there from the start. See how it fits your sites: book a free demo.

ISO audit evidence by clause: prepare once, pass every audit