Safety Audits are about evaluating if your health and safety management system is doing what its supposed to do. To do this Safety Auditors need evidence, sourced from visual observations, interviews with management and employees as well as reviewing documents, data and records.

But is all evidence created equal?

Not at all.

Each type of evidence has its own pros and cons and Safety Auditors have to evaluate just how reliable and objective the evidence is that is presented to them.

Visual observations can tell you how people are working on the day of the Audit, but like many things, safety practices can improve when people know you're watching.

Interviews and conversations with people can give you an insight into their knowledge and understanding, but it can't corroborate that they always act that way.

Whilst using only documentation and records to evaluate a HSMS has its own drawbacks, they often provide the most reliable and objective evidence to Safety Auditors of how the HSMS has been applied over a period of time. So, making sure you have the right documentation and records is important if you want a strong audit result.

Beyond providing objective evidence, documented processes and records are often a minimum requirement of many Audit Standards. Failure to document such a process will likely result in a non-conformance, regardless of how well you are actually managing health and safety risks.

You must also remember that not all Audit Standards require documented procedures or even use the same terminology to describe what they want. Let's take a quick look at each.

Terminology

Audit Standards often use different terminology to describe requirements. If we look at some common Audit Standards (below) we can see that the term "Procedures" is not used interchangeably:

• AS/NZS 4801 – Requires Procedures to satisfy many criteria but only some of these Procedures are required to be 'documented.'
• OHSAS 18001 - Requires Procedures to satisfy some criteria, but "Procedures" are defined as a 'specified way to carry out an activity or a process, that can be documented or not.'
• National Audit Tool V3 – Requires Procedures to satisfy some criteria, and defines a Procedure as a document in text or graphic form.

So, amongst three common Audit Standards, we have three different requirements when it comes to documenting Procedures.

To confuse this even further, OHSAS18001 does require Procedures to be documented where their absence could lead to deviations from the OHS Policy and OHS Objectives. 

Criteria

 We also know that not all Audit Standards require Procedures for the same parts of an HSMS. Below is a small sample comparing Procedural requirements from the same three Audit Standards.

We can see from the examples above that it's important to know and ready the minimum mandatory documentation if you want to get through you audit successfully.

Whilst not every HSMS requirement demands a documented procedure, you should carefully consider how to ensure that complex processes are followed systematically each time. Whilst Hazard Identification, Risk Assessment & Control (HIRAC) processes don't specifically need to be documented to satisfy OHSAS 18001, consider how difficult it would be to ensure a consistent outcome each time if the intent, scope, process, responsibilities and timeframes required of HIRAC procedures weren't documented.

In addition, be sure you prepare your Documentation in accordance with document control requirements.

Having satisfied documentation requirements, it's time to consider Data (registers, incident data, training needs analysis) and Records (completed Permit to Work forms, training attendance records, plant maintenance records). Where Procedures outline an intent, Data and Records demonstrate whether activities match intent.

In any audit, there is generally more data and more records available than can be evaluated. This necessitates a sampling approach where the Auditor will select example records at random. The sample size depends on many factors, the regularity and frequency of tasks as well as considering the level of risk.

It's not uncommon for Auditees to prepare a sample of evidence for the Auditor, often with the best of intentions (though not always, but we will talk about that in future blog entry). Whilst Auditors will often appreciate the effort, a good Auditor won't rely solely on what is provided to them and will seek additional evidence to verify that the provided sample is representative.

If you don't have ready access to data and records, an inquisitive Auditor will begin to wonder why. This might mean a more thorough evaluation or even larger evidence sample to satisfy their curiosity, both of which provide greater opportunity for Auditors to find errors or omissions (it is, after all, a big part of what we are trained to do). This may also result in a non-conformance against record keeping requirements.

Finally, make sure the Records you do provide are current. If your records are too old, or in a different format to what they are supposed to be, the records are unlikely to be accepted as suitable evidence. Most auditors are likely to want to see evidence that applies to the last 3-6 months at least.

That certainly seems like a lot to take in, so let's summarise quickly:

1. Documentation and records contribute significantly to objective evidence, so any audit will require the review of a sufficient amount of such evidence.
2. Know what Standard your auditing against and make sure you know what the minimum documentation requirements are.
3. Beyond the minimum requirements, consider what other complex processes should be documented to aid in their systematic application.
4. Prepare your documentation in accordance with your own Document Control Procedures.
5. Make sure you have access to current and relevant records during the audit 

In our next blog entry, we will talk about giving your Auditor time to prepare. If you are interested in this or other ways to improve your Safety Audits, join our community by subscribing and over the coming weeks, we will outline common Safety Audit pitfalls and practical ways to avoid them.