Audit

A safety audit is a systematic, documented review that checks whether a site, process or safety management program meets defined requirements, such as company procedures, OSHA regulations or ISO 45001. Auditors gather objective evidence through records, interviews and observation, compare it against those criteria, and report findings that lead to corrective action.

Audits are one of the main ways an organization confirms that its written safety program matches what happens on the floor. They are used across general industry, construction, process plants and fleets.

What Is an Audit?

ISO 19011:2018, the international guideline for auditing management systems, describes an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled. In plain terms, an audit asks two questions: what are we supposed to be doing, and are we actually doing it?

The "audit criteria" are the requirements being checked. In EHS work they usually include:

• Federal and state regulations, such as OSHA standards or FMCSA rules
• Management system standards, such as ISO 45001
• Internal policies, procedures and work instructions
• Customer, insurer or contractor prequalification requirements

Some OSHA standards require audits outright. Under the Process Safety Management standard, 29 CFR 1910.119(o), employers must certify that they have evaluated compliance with the standard at least every three years, using at least one person knowledgeable in the process. They must develop a report of findings, promptly determine and document a response to each finding, document that deficiencies were corrected, and keep the two most recent audit reports.

Why Safety Audits Matter

Written programs drift over time. People change roles, equipment is replaced, procedures get shortcuts, and training lapses. An audit is a scheduled, structured check that catches that drift before it shows up as an incident or a citation.

Audits also feed the "Check" stage of the Plan-Do-Check-Act cycle. OSHA's Recommended Practices for Safety and Health Programs list program evaluation and improvement as a core element and advise employers to review the results of compliance audits to confirm that program shortcomings are being identified. Without that check, management has no reliable way to know whether controls are working.

Finally, audits produce evidence. A documented audit history shows regulators, customers and insurers that the organization verifies its own compliance rather than waiting to be told.

Types of Audits

By who performs the audit

• First-party (internal) audits: performed by the organization's own staff or by consultants acting on its behalf. ISO 45001 clause 9.2 requires internal audits at planned intervals.
• Second-party audits: performed by a customer or client on a supplier or contractor, often as part of prequalification.
• Third-party audits: performed by an independent body, such as a certification registrar auditing against ISO 45001.

By what is being audited

• Compliance audits: check conformance with specific regulations, such as OSHA recordkeeping, hazard communication or PSM.
• Management system audits: check whether the overall safety management system is designed and operating as intended.
• Program or topic audits: focus on one program, such as lockout/tagout, confined space entry or contractor safety.
• Fleet and DOT audits: review driver qualification files, hours of service records, vehicle maintenance and drug and alcohol testing records.

Audit vs. Inspection

The two terms are often used interchangeably, but they answer different questions.

• An inspection looks at physical conditions at a point in time: guarding in place, exits clear, extinguishers charged, forklift brakes working. Inspections are frequent, often daily or weekly, and usually use a checklist.
• An audit looks at the system behind those conditions: Is there a procedure? Are people trained on it? Are inspections being done and documented? Are findings closed out? Audits are less frequent, often annual or every few years, and rely on records and interviews as well as observation.

A missing machine guard is an inspection finding. Discovering that guard inspections have not been documented for six months, and no one is assigned to do them, is an audit finding. Both are needed, and a good audit will sample inspection records as part of its evidence.

How to Conduct a Safety Audit

1. Define the scope and criteria. Decide which site, department or program is being audited and which requirements apply. A narrow, clear scope produces better findings than a vague "check everything" audit.
2. Select qualified auditors. Auditors should understand the process and the requirements, and ideally should not audit their own work. PSM audits require at least one person knowledgeable in the process.
3. Build or update the protocol. Turn each requirement into an audit question with the evidence needed to answer it, such as "Is the energy control procedure inspected at least annually? Evidence: signed periodic inspection records."
4. Review documents first. Examine written programs, training records, inspection logs, the OSHA 300 Log and prior audit reports before arriving on site.
5. Collect evidence in the field. Observe work, interview supervisors and frontline workers, and verify that what people describe matches the written procedure. Record objective evidence for each finding.
6. Hold a closing meeting. Share preliminary findings with site leadership so there are no surprises and factual errors can be corrected.
7. Issue the report. Classify findings by severity, reference the specific requirement for each, and note positive practices as well as gaps.
8. Assign and track corrective actions. Every finding should become a corrective and preventive action (CAPA) with an owner, a due date and a verification step.

Examples of Audit Findings

The following hypothetical examples show how findings are typically written, with the requirement, the evidence and the gap:

• Lockout/tagout: 29 CFR 1910.147(c)(6) requires periodic inspection of energy control procedures at least annually. Records for 4 of 12 sampled procedures showed no inspection in the past 14 months.
• Hazard communication: Two chemicals in the maintenance shop had no safety data sheet available in the SDS binder or electronic system.
• Training: Three newly hired forklift operators had no documented evaluation of their performance before operating trucks.
• Fleet: One driver qualification file was missing the annual review of the driver's motor vehicle record.

Common Audit Mistakes to Avoid

• Treating the audit as the goal. The value comes from closing findings, not from producing a report. Track closure rates and overdue actions.
• Auditing only paperwork. Records can look perfect while practice on the floor is different. Always verify in the field.
• Using the same checklist forever. Update the protocol when regulations, processes or risks change.
• Blaming individuals. Audit findings usually point to system gaps such as unclear procedures or missing resources. Use root cause analysis for significant or repeat findings.
• Skipping verification. Closing an action is not the same as fixing the problem. Check at the next audit that the fix held.

Best Practices for an Effective Audit Program

• Set a risk-based schedule so higher-hazard sites and programs are audited more often.
• Use standardized protocols so results can be compared across sites and over time.
• Rotate auditors between sites to bring fresh eyes and share good practices.
• Involve frontline workers in audits. They often know where the gaps are.
• Report audit results to senior leadership along with corrective action status.
• Trend findings by category to spot systemic weaknesses that single audits miss.

How SMS360 Helps

SMS360's Audit Management module lets teams build audit and inspection checklists, complete them on mobile devices in the field, and attach photos as evidence. Findings can be turned into assigned corrective actions with owners, due dates and reminders, so nothing is left in a spreadsheet. Completed audits are stored as records, and dashboards show audit scores, open findings and overdue actions across sites.

Frequently Asked Questions

What is the purpose of a safety audit?

The purpose of a safety audit is to verify, with objective evidence, that a safety program or process meets its requirements and is working as intended. Audits identify gaps between written procedures and actual practice, uncover missing records or training, and produce findings that drive corrective action. Over time, a consistent audit program helps prevent incidents and shows regulators and customers that the organization checks its own compliance.

How often should safety audits be conducted?

Frequency depends on risk and regulation. OSHA's PSM standard requires compliance audits at least every three years, and ISO 45001 requires internal audits at planned intervals. Many organizations audit each site annually and audit high-hazard programs, such as lockout/tagout or confined space entry, more often. A risk-based schedule that considers incident history, prior findings and process changes is a sound approach.

What is the difference between an internal and external audit?

An internal (first-party) audit is performed by the organization's own staff or a consultant working on its behalf, mainly to find and fix gaps. An external audit is performed by an outside party, such as a customer (second-party) or a certification body (third-party). External audits often carry formal consequences, such as certification decisions or supplier approval, which is why strong internal audits are good preparation.

Is a safety audit required by OSHA?

OSHA does not require a general safety audit for every employer, but some standards include audit or periodic review requirements. The PSM standard, 29 CFR 1910.119(o), requires compliance audits at least every three years, and the lockout/tagout standard requires periodic inspection of energy control procedures at least annually. OSHA's Recommended Practices also encourage regular program evaluation for all employers.