Most construction businesses have a site inspection checklist. Fewer run internal audits. The two get treated as the same thing, and they aren’t.
An inspection checks conditions on the day. Are the barricades up, is the housekeeping acceptable, are the extinguishers tagged? Those things matter, and a supervisor should be checking them every week.
An audit asks a harder question: is the safety system producing safe work? It takes one task and follows the trail. Is the SWMS for that task on site? Does it describe what the crew is actually doing? Are the controls it names in place? Are the people doing the work licensed, inducted and competent? Were the actions from the last audit closed, and did the fix hold?
An inspection finds a missing barricade. An audit finds out why it keeps going missing.
Why run internal audits
Officers have to verify. Under the Work Health and Safety Act 2011 (Qld) s 27(5), an officer’s due diligence includes taking reasonable steps to ensure the business has, and implements, processes for complying with its duties (para (e)), and to verify the provision and use of those resources and processes (para (f)). A policy signed by a director isn’t verification. A site audit, with findings reported back to the officers, is.
SWMS have to be followed. For high risk construction work, the Work Health and Safety Regulation 2011 (Qld) s 300 requires arrangements to ensure the work is carried out in accordance with the SWMS, and work that departs from it must stop until it is back in line. An internal audit is how you find out whether those arrangements work. When controls change, s 38 and s 302 require the control measures and the SWMS to be reviewed.
ISO 45001 requires it. Clause 9.2 requires internal audits at planned intervals, run to an audit programme. If you’re certified, your certification body will expect to see the programme, the reports and the corrective actions that came out of them. ISO 19011:2018 gives guidance on how to run them.
Someone else will audit you anyway. Principal contractors, clients and prequalification schemes audit their contractors. It’s cheaper to find the gaps yourself.
What a useful site audit covers
- The highest-risk work on site that day. Not the easiest task to check. If there’s a crane lift, excavation or work at height running, start there.
- The SWMS against the task. Read it, watch the work, and talk to the crew. Ask them what the controls are before you show them the document.
- Competency. High risk work licences, inductions, and any verification of competency the SWMS relies on.
- Plant. Pre-start checks completed and genuine, maintenance current, and defects acted on.
- Subcontractor interface. SWMS received from subcontractors before they started (s 301), and reviewed by someone who understood them.
- Previous findings. Closed, and still closed.
- Site records. Registers current, including the hazardous chemicals register and SDSs where chemicals are on site.
The audit tool should fit the work. A two-page tool that gets used beats a forty-page one that doesn’t.
Making the findings count
An audit report nobody acts on is a record that you knew. Every finding needs an owner, a due date and a check that the fix worked. ISO 45001 clause 10.2 calls that corrective action.
Look for patterns as well. One missing permit is a lapse. The same missing permit on three sites means the system is producing the problem. Trends across audits belong in management review (clause 9.3) and in the reports your officers receive.
Who should do the auditing
Clause 9.2.2(c) requires auditors to be selected so that audits are objective and impartial. A supervisor auditing their own site is checking their own work. In a smaller business that can be managed by swapping supervisors between sites, with an external audit at set intervals to calibrate the internal ones.
How Safeguard helps
- Audit programme. Frequency and scope set by risk and by what previous audits found, as clause 9.2.2(a) requires.
- Audit tool. Built around your SWMS, plant and high-risk activities, sized to your business.
- Independent internal audits. I audit your sites and report findings in a form your officers can act on. My audit work includes surveillance audits engaged by principals to oversee contractor supply chains, and I’m one of the few Federal Safety Officers in Australia.
- Supervisor training. So your own people can run audits between external ones.
Learn more about our auditing and compliance services, or talk to us about an audit programme.
Frequently asked questions
How often should we audit?
ISO 45001 leaves it to you, provided the programme considers the importance of the processes and the results of previous audits. In practice, high-risk projects get audited more often, and a poor result brings the next audit forward.
Is an inspection checklist enough?
No. Inspections are part of monitoring. An audit checks whether the system is working, including whether the inspections are being done properly.
Can our safety advisor do the internal audits?
Yes, for parts of the system they don’t run day to day. They shouldn’t be the only auditor of processes they own.