[ISO 45001 Series] Performance Evaluation: Recommendations and Methods

Introduction

As outlined in the author’s article “[ISO 45001 Series] Planning: Overview of Controls and Planning Risk Controls,” the most basic theoretical framework of an occupational health and safety management system comes from systems theory developed in the natural and social sciences.

An occupational health and safety management system is an open system. It exchanges information with its external environment, including laws, public expectations, and economic conditions. When risk controls or measures to improve the OH&S management system are introduced and implemented, outputs may include lower occupational-accident rates and reduced property loss.

Risk is abstract, particularly because occupational accidents are often low-probability events and may never have occurred in an organization. It is therefore difficult to determine directly whether a specific control or a procedural improvement has reduced or eliminated risk to workers. Other means are needed to determine whether the OH&S management system is suitable, adequate, and effective.

ISO 45001 structures the overall operation of an OH&S management system around the PDCA cycle. Determining whether the system is suitable, adequate, and effective belongs to the Check stage: the organization monitors, measures, and analyzes OH&S performance, then evaluates that performance.

Although performance evaluation belongs broadly to the C in PDCA, an organization naturally has to monitor, measure, and analyze OH&S performance before it can plan and conduct an evaluation. The sections below therefore discuss both activities, drawing on ISO 45001, practical guidance, and the author’s recommendations for making the process operational.

Meaning and Concept of Occupational Health and Safety Performance

Under ISO 45001, “performance” means a measurable result related to an activity, process, product, system, or organization. The result may be determined and evaluated by qualitative or quantitative methods.

Within an OH&S management system, “occupational health and safety performance” concerns the effectiveness of preventing injury and ill health among workers and providing safe and healthy workplaces. If ventilation is used to reduce a hazardous substance in the workplace, for example, the concentration of that substance may serve as an OH&S performance measure.

The author suspects that ISO 45001 uses the broad term “OH&S performance” because it is a general-purpose standard. Performance can take many forms across organizations of different sizes and controls of different kinds, so the general term avoids narrowing the possible measures too far.

Monitoring, Measurement, and Analysis of OH&S Performance

Before evaluating OH&S performance, an organization must first monitor, measure, and analyze it. ISO 45001 provides definitions relevant to these activities:

“Measurement” determines a quantitative value for a particular object or event—for example, using calibrated or verified equipment to measure exposure to a hazardous substance.

“Monitoring” means continuously checking, supervising, critically observing, or determining status in order to identify changes from the required or expected performance level. It may include interviews, review of documented information, and observation of work in progress.

“Analysis” is the process of examining data to reveal relationships, patterns, and trends. Statistical methods may be used, and analysis is usually integrated with measurement activities.

ISO 45001 requires measuring equipment to be calibrated or verified where practicable, and to be properly used and maintained, so that monitoring, measurement, and analysis produce valid results.

Whether the next step is monitoring, analysis, or performance evaluation, measurement is the essential starting point.

In the author’s reading of ISO 45001, measurement produces quantitative values for specific objects or events. Unlike a risk rating that may rely partly on an assessor’s judgment, a measurement should provide an objective and accurate quantitative value.

Monitoring and measurement should include, but are not limited to: (1) occupational-health complaints, workers’ health, and the work environment; (2) work-related incidents, injuries, ill health, and complaints; (3) the effectiveness of operational controls, emergency exercises, and newly introduced controls; and (4) worker competence. Appropriate documented information must be retained for the results and for the maintenance, calibration, and verification of measuring equipment.

For an organization, monitoring, measurement, and analysis therefore raise two central questions: which OH&S performance measures should be monitored, measured, and analyzed, and at what times and frequency?

Which OH&S Performance Measures Should Be Monitored, Measured, and Analyzed?

ISO 45001 indicates that the OH&S performance to be measured should cover: (1) the extent to which legal and other requirements are fulfilled; (2) activities and operations related to identified hazards, risks, and opportunities; (3) progress toward OH&S objectives; and (4) the effectiveness of operational and other controls.

Fulfillment of Legal and Other Requirements

Using the author’s articles “[ISO 45001 Series] Identifying Internal Issues in the Context of the Organization” and “[ISO 45001 Series] Defining External Interested Parties and External Issues,” an organization can identify the legal and other requirements it must fulfill while examining the needs and expectations of internal and external interested parties. Those requirements can then define performance measures. If the law limits the concentration of a substance in the work environment, for example, that concentration should be measured as OH&S performance.

Activities and Operations Related to Identified Hazards, Risks, and Opportunities

In “[ISO 45001 Series] Planning: Overview and Hazard Identification,” the author proposes building a hazard-identification checklist from applicable OH&S legislation. For that reason, the author suggests measuring this ISO 45001 category together with the fulfillment of legal and other requirements.

Articles 20 through 22 of Taiwan’s Occupational Safety and Health Act also require employers to provide periodic health examinations for workers. In the author’s view, these examinations form part of performance measurement under activities and operations related to identified hazards, risks, and opportunities.

Progress Toward OH&S Objectives

The author recommends expressing OH&S objectives as measurable performance, such as an incident rate, instead of leaving them as vague aspirations. Progress can then be measured directly through frequency, severity, quantity, percentage completion, or another value appropriate to the objective.

Effectiveness of Operational and Other Controls

When planning risk controls, management-of-change measures, or emergency arrangements, the author recommends examining the purpose of each control to decide what OH&S performance should be measured and how.

If a control is intended to isolate workers from a hazardous substance, personal exposure to that substance may be used as the OH&S performance measure.

If an emergency measure is intended to reduce harm when an emergency occurs, the severity of casualties during an emergency may serve as the performance measure.

The organization can use statistical analysis to identify relationships, patterns, and trends in measured OH&S performance, while monitoring through interviews, review of documented information, and observation of work to determine whether performance changes as expected.

When and How Often?

ISO 45001 and the practical guidance cited by the author do not prescribe a single schedule for this issue.

For performance related to fulfillment of legal and other requirements, the author recommends measuring not only monthly, quarterly, or annually, but also whenever legal or other requirements change or when operations and controls are updated. The organization must also ensure that its legal and other requirements remain current.

For progress toward OH&S objectives, the author recommends measuring again whenever the organization changes its OH&S management system.

When hazards or risks themselves are used as performance measures, or when the effectiveness of operations and controls is measured, timing and frequency can depend on potential severity and likelihood. High-risk conditions may require continuous monitoring, while lower-risk conditions may be checked at intervals such as hourly or daily.

Planning and Conducting OH&S Performance Evaluation

Monitoring, measurement, and analysis alone are not enough. Results must be compared against an appropriate set of criteria before the organization can decide whether its OH&S management system is suitable, adequate, and effective. That comparison is the purpose of performance evaluation.

ISO 45001 uses the following concepts when discussing suitability, adequacy, and effectiveness:

Suitability: whether the OH&S management system fits the organization, its operations, culture, and business systems.

Adequacy: whether the OH&S management system is appropriately implemented.

Effectiveness: whether the OH&S management system achieves its intended results.

Relevant ISO 45001 Requirements

The author organizes ISO 45001 performance evaluation into three approaches: evaluation of compliance, internal audit, and management review. Each is introduced below.

Evaluation of Compliance

Evaluation of compliance compares performance with legal and other requirements. Legal requirements include applicable legislation and legally binding collective agreements, and the organization must keep this information current. Other requirements may include company policies, rules and regulations, and insurance requirements.

The organization must determine the frequency and methods of compliance evaluation. Timing may vary with the importance of a requirement, changes in operating conditions, or changes in legal and other requirements. Different methods may be used to maintain knowledge and understanding of compliance status. Evaluating compliance gaps helps the organization decide what to do during Improvement, and documented information on the results must be retained.

Internal Audit

An audit is a systematic, independent, and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

Under the definition referenced through CNS 14809, “audit evidence” means records, statements of fact, or other information that are relevant to the audit criteria and verifiable.

“Audit criteria” are the set of policies, procedures, or requirements used as the reference against which audit evidence is compared.

Audits may be internal, external, or combined. For an OH&S management system, ISO 45001 requires internal audits. An internal audit may be conducted by the organization itself or by an external party; it does not cease to be internal merely because an outside person performs it.

ISO 45001 requires internal audits to determine whether the OH&S management system conforms to the organization’s own requirements and to the requirements of ISO 45001, and whether it is effectively implemented and maintained. In this comparison, the author treats the management-system and standard requirements as audit criteria and the performance results as evidence. ISO 45001 also sets requirements and considerations for conducting internal audits.

The organization must plan, establish, implement, and maintain an audit programme covering frequency, methods, responsibilities, consultation, and other arrangements. Previous audit results must be considered, and the breadth of the programme may depend on the maturity and complexity of the OH&S management system.

For each audit, the organization must define the criteria and scope used to compare performance. Examples of comparative criteria discussed in guidance include other organizations, standards and specifications, the organization’s own rules and objectives, and OH&S statistics.

The audit process must be objective and impartial. To support objectivity and impartiality, the organization may select auditors whose audit duties are separated from their usual responsibilities or use external personnel.

After the audit, results must be reported to relevant management, workers and their representatives, and other relevant interested parties. Documented information must be retained as evidence and as an input for deciding improvement measures.

Management Review

OH&S responsibilities and authorities may be delegated, but top management retains ultimate accountability.

Another form of performance evaluation is top management’s review of the OH&S management system at planned intervals. The review supports decisions on: (1) the system’s continuing suitability, adequacy, and effectiveness in achieving intended outcomes; (2) opportunities for continual improvement; (3) needs for changes to the system; (4) resources; (5) actions for improvement; (6) opportunities to improve integration with other business processes; and (7) implications for the organization’s strategic direction.

The review must consider matters including: (1) the status of previous management reviews; (2) changes in internal and external issues; (3) the extent to which OH&S policy and objectives have been met; (4) OH&S performance; (5) adequacy of resources; and (6) communications with interested parties.

The organization may review different matters at different times and in different ways. It must retain documented information on the outputs both for future reference and as evidence of management-review results.

The Author’s Recommended Practical Approach

As explained above, an organization must monitor, measure, and analyze OH&S performance. Yet without comparison, it cannot determine its current level of performance or set a direction for improvement. Performance evaluation is therefore still required.

For OH&S performance evaluation, ISO 45001 addresses evaluation of compliance, internal audit, and top-management review and provides requirements and guidance for each.

Looking at their functions, the author finds that evaluation of compliance and internal audit can be combined into one performance-evaluation procedure. The reasoning is explained below.

The author therefore recommends dividing this part of OH&S performance evaluation into two practical routes: an OH&S performance audit and management review.

Occupational Health and Safety Performance Audit

Evaluation of compliance compares the organization’s OH&S performance with legal and other requirements to determine whether it complies with law and the requirements of other interested parties.

Internal audit is the process by which the organization plans, establishes, and implements audit programmes to obtain audit evidence, compare it with audit criteria, reach audit findings and conclusions, and examine the effectiveness, suitability, and adequacy of the OH&S management system.

The ISO 45001 internal-audit requirements focus on how an organization plans and implements an audit programme to obtain evidence. In the author’s practical interpretation, comparing that evidence with the criteria and reaching findings and conclusions performs the compliance-evaluation function.

Although ISO 45001 treats the two as distinct performance-evaluation activities, the author therefore considers both to be parts of performance auditing and combines them into one practical method.

The 2022 Basis and the Standards Current in 2026

When this article was published in 2022, its audit process primarily followed the 2019 practical manual cited by the author and was organized around the second edition, ISO 19011:2011, and the earlier corresponding CNS 14809 framework. The original process, tables, and figures below are preserved to show the operating logic of the initial article._[3]

Subsequent revision: Taiwan’s Bureau of Standards, Metrology and Inspection announced a revised CNS 14809 on December 14, 2020. The revision harmonized the national standard with ISO 19011:2018, strengthened its treatment of risk, and integrated common competence requirements for auditors of different management systems. In practice, the 2011 framework should therefore no longer be treated as the sole current basis._[4]

Current version status: ISO 19011:2018 was withdrawn in May 2026 and replaced by ISO 19011:2026._[5][6] The three figures in this article remain useful for understanding the organization of audit programmes, audit activities, and reporting. When formally establishing or updating an audit system, however, users should separately check ISO 19011:2026, the currently effective edition of CNS 14809, ISO 45001, and applicable legislation. The older figures should not be used as a substitute for the latest standards.

ISO 45001 does not prescribe a complete step-by-step process for conducting internal audits; it mainly identifies matters such as objectivity, impartiality, and reporting to management. Drawing on practical guidance,_[1] the author originally recommended referring to the Guidelines for Auditing Management Systems in CNS 14809, which at that time was described through the second edition of ISO 19011 issued in 2011. The resulting process is shown below.

Although auditing is part of Check in an OH&S management system, an audit is also a process with its own PDCA cycle: it must be planned, conducted, checked, and improved.

To give the audit programme an overall direction, top management first considers legal and contractual requirements, previous audit results, management priorities, business intentions, and other factors when defining programme objectives. The objective might be to determine management-system effectiveness or verify conformity with an interested party’s requirements. Like OH&S policy and objectives, audit-programme objectives give the process direction for the arrangements that follow.

After the programme objectives are confirmed, the organization may appoint a person competent to manage the audit programme—someone familiar with audit principles, procedures, methods, and the auditee. This person takes primary responsibility for establishing programme procedures, determining programme extent and necessary resources, and setting objectives, scope, and criteria for individual audits.

CNS 14809 distinguishes audit types according to who performs them. An audit performed by the organization itself, or on its behalf, for management review or other internal purposes is an internal audit, also called a first-party audit.

An audit not performed by or on behalf of the organization is an external audit. An audit performed by an interested party, or on its behalf, is a second-party audit. An audit performed by an independent organization, such as a certification body or regulator, is a third-party audit.

ISO 45001 requires the organization to conduct internal audits. As noted above, an audit performed by employees or by an outside party remains an internal audit when it is conducted for management review or another internal purpose. The person managing the audit programme therefore need not be an employee and may come from an external organization.

The audit-programme manager determines the programme’s extent according to the organization’s size and the management system’s nature, functionality, complexity, and maturity. Objectives, duration, frequency, criteria, language, cultural and social issues, and other factors may affect its scope. Available resources must also be identified, including finance, competent auditors, technical experts, and information and communication technology.

Once resources are understood, one or more procedures can address the competence of the audit team and lead auditor, audit methods, and reporting of overall programme performance. The organization selects methods and team members, assigns lead-auditor responsibilities for each audit, and provides information such as objectives, criteria, and scope before the work begins.

Factors for selecting audit-team members include: (1) the team’s overall competence in light of scope and criteria; (2) audit complexity; (3) selected methods; (4) legal, contractual, and other committed requirements; (5) independence of team members from the activities being audited; (6) ability to interact and work effectively with auditee representatives; and (7) language and the auditee’s social and cultural characteristics.

ISO 45001 allows an organization’s own workers to audit the OH&S management system. To maintain objectivity and impartiality, however, their audit assignments should be separated from their normal responsibilities. If the organization still has concerns, the author recommends engaging an independent external party to conduct the internal audit.

When selecting audit methods, the CNS 14809 framework distinguishes approaches according to the auditor’s location and the degree of interaction between auditor and auditee. The methods used in the original article are summarized below.

The author recommends selecting audit criteria during audit planning. Legal and other requirements already identified while examining the organization’s context can be reused as criteria, rather than being researched again at this stage.

Unlike the operational controls discussed earlier, an audit still requires some planning by the lead auditor after the audit programme is established and while an individual audit is being prepared. Not every procedural detail is finalized before implementation begins.

The lead auditor therefore arranges and assumes responsibility for the individual audit, while the audit-programme manager monitors implementation. Monitoring may include evaluating alignment with programme objectives, the audit team’s ability to implement the plan, and feedback from top management or other interested parties.

Before formally conducting the audit, the audit team makes initial contact with the organization. The contact may be formal or informal and is intended to establish communication with the organization’s representative, confirm authority to conduct the audit and relevant agreements, and identify areas of interest or concern. Considering cooperation, time, and resources, the team then determines feasibility. If the audit is not feasible, alternatives or another assignee can be discussed.

If the audit is feasible, the team prepares the audit activities. It first reviews management-system documents, both to prepare appropriate working documents and to identify possible omissions through preliminary document review.

Using the audit programme and the organization’s documents, the lead auditor considers sampling techniques, team competence, and other factors when preparing the audit plan. The plan supports efficient scheduling, coordination, and achievement of the objectives. Suggested contents include objectives, scope, criteria, team responsibilities and work assignments, and allocation of audit resources.

Based on the lead auditor’s plan, selected methods, and collected information, team members prepare working documents such as checklists, sampling plans, and forms for recording information. Documents containing confidential information must be appropriately protected.

Drawing on practical guidance, the author prepared the sample internal-audit record below. Although it supports the overall audit process, its contents still belong primarily to the planning stage.

Before applying the planned audit methods, the team holds an opening meeting to confirm agreement on the audit plan, introduce the team, and confirm that planned activities can be carried out. The CNS 14809 framework suggests that top management or the head of the audited function chair the meeting, which may improve worker cooperation during the audit.

Communication must be maintained within the team and between the team and the organization. Information relevant to objectives, scope, and criteria is verified as audit evidence and compared with the criteria to produce findings, supporting evaluation of the OH&S management system’s effectiveness, suitability, and adequacy.

Because ISO 45001 requires audit results to be reported to relevant management, workers and their representatives, and other relevant interested parties, the author recommends a closing meeting to present findings and conclusions. The meeting can explain the evidence collected, how findings were reached, possible outcomes, and follow-up activities. A complete audit report is then retained as the documented information required by the management system.

The original CNS 14809-based outline in this article lists the following for a complete audit report: (1) objectives; (2) scope; (3) identification of the audit client; (4) identification of the audit team and participating auditee personnel; (5) dates and locations of on-site activities; (6) criteria; (7) findings and related evidence; (8) conclusions; and (9) a statement on the degree to which the criteria were fulfilled.

Afterward, the audit-programme manager reviews the programme, evaluates whether its objectives were achieved, uses the result as an input for continual improvement of the next programme, and reports the programme review to top management.

Management Review

ISO 45001 does not require top management to personally perform every OH&S management-system duty; authority may be delegated when appropriate. Top management nevertheless retains ultimate accountability.

Management review therefore considers previous review status, changes in internal and external issues, achievement of OH&S policy and objectives, resource adequacy, OH&S performance, and communications with interested parties. It supports decisions on continual-improvement opportunities and actions, management-system changes, and the system’s suitability, adequacy, and effectiveness.

ISO 45001 does not prescribe exactly how or when management should conduct this review. Drawing on practical guidance,_[2] the author recommends holding a management-review meeting after the internal audit to discuss the matters above.

Conclusion

Without an appropriate checking process, an organization cannot know whether its controls are effective and therefore cannot improve ineffective controls. That is why performance evaluation is necessary.

Risk is abstract. Although it relates to severity and likelihood, a hazard that has never occurred within the organization can be difficult to quantify—and even harder to improve directly.

ISO 45001 therefore uses OH&S performance measures such as contaminant concentration or occupational-accident frequency as indirect, observable results instead of trying to evaluate performance solely by quantifying risk. These measures have the advantage of being easier to compare and use.

The author combines the performance-evaluation approaches in ISO 45001 into two practical steps and connects them with the processes introduced in earlier articles, making the overall OH&S management-system workflow easier to follow.

The next article is the final entry in this ISO 45001 series. It turns to Improvement, the last stage of PDCA. See you there : D.

References

[1] Industrial Development Bureau, Ministry of Economic Affairs, Practical Manual for Promoting ISO 45001 Occupational Health and Safety Management Systems in Manufacturing, 2019, p. 107. [Chinese source]

[2] Ibid., pp. 109–110.

[3] International Organization for Standardization, ISO 19011:2011, Guidelines for auditing management systems, second edition, 2011. Withdrawn and replaced by ISO 19011:2018. Accessed September 6, 2026: https://www.iso.org/standard/50675.html

[4] Bureau of Standards, Metrology and Inspection, Ministry of Economic Affairs, “Announcement of the Revised National Standard Guidelines for Auditing Management Systems,” January 18, 2021. https://www.bsmi.gov.tw/wSite/ct?ctNode=8322&mp=58&xItem=92327

[5] International Organization for Standardization, ISO 19011:2018, Guidelines for auditing management systems, third edition, 2018. Withdrawn and replaced by ISO 19011:2026. Accessed September 6, 2026: https://www.iso.org/standard/70017.html

[6] International Organization for Standardization, ISO 19011:2026, Guidelines for auditing management systems, fourth edition, 2026. Accessed September 6, 2026: https://www.iso.org/standard/19011