A health and safety audit examines whether your arrangements work, as distinct from an inspection, which examines whether a place is safe today. The difference decides what each one finds: an inspection finds a blocked fire door; an audit finds out why nobody noticed it for six weeks. Both are worth doing and firms usually do only the first, because it is faster, more visible and does not raise questions about management. This page is about the second.
Audit against arrangements, inspect against conditions
An audit takes what your policy and arrangements say happens and tests whether it does: are assessments being reviewed on the stated cycle, are incidents investigated and actions closed, are new starters inducted, are contractors selected the way the policy says. It works from records and from asking people, and its findings are about systems. An inspection walks the workplace and records what is unsafe now. The two produce different lists and both lists are useful.
What an audit needs before it can be done at all
Records that exist and can be found. An audit against a document set nobody can produce is not an audit, it is a discovery exercise, and the finding is already known. This is the unglamorous prerequisite: dated assessments with authors, incident records with actions and owners, briefing records, and a review history. Firms whose file is a shared drive usually discover during their first audit that the audit is impossible.
Findings die unless they have an owner and a date
The predictable failure of internal audits is a report with twenty observations, none of which has a name against it, filed and revisited a year later to find most still open. A finding without an owner and a date is an opinion. The discipline that makes audits worth their cost is small: every finding gets a person, a date and a place in the same system as the records it came from, so the next audit starts by checking the last one's actions.
Size it before you commit to a cycle
An audit's cost is dominated by how much there is to audit and how findable it is. A firm with thirty assessments, a live incident record and dated reviews can be audited in a day; the same firm with the same documents scattered across email cannot. The free risk assessment form worksheet on this site prices the assessment programme an audit will examine, which is a good proxy for how big the audit itself will be.
Questions people ask about health and safety audit
What is the difference between a health and safety audit and an inspection?
An inspection looks at conditions in a workplace at a point in time; an audit looks at whether your management arrangements are working, using records and interviews. An inspection finds the blocked door, an audit finds out why the weekly check that should have caught it was not happening.
How often should a health and safety audit be done?
There is no fixed interval in law for most firms. Annual is common for a full audit with lighter checks in between, and the right frequency follows from how much changes: a firm with new sites, new processes or a rising incident count should look more often than a stable one.
Who should carry out the audit?
Someone competent and sufficiently independent of the arrangements being audited to report honestly. That can be an internal person from outside the function, or an external auditor. The person who wrote the arrangements auditing their own operation is the arrangement most likely to produce a clean report and no learning.