Health and safety audit: how to audit yourself, with a checklist

What a health and safety audit is

An audit looks at the system, not the shop floor. It asks three questions about each part of how you manage health and safety:

• Does it exist? Is there a policy, a risk assessment, a training record?
• Is it followed? Do people do what the document says?
• Does it work? Are the risks under control as a result?

The third question is the one that separates an audit from a paperwork check. A firm can have every document in place and still have a guard tied back on the saw. HSE's guidance on measuring performance makes the same point: paperwork on its own is not a good measure of how well you are doing.

Audit or inspection: the difference

The two words are often used for the same thing. They are different jobs.

You need both. Inspections catch the trailing cable. The audit asks why there are trailing cables every month. For the walk-round itself, use our workplace inspection checklist.

Is a health and safety audit a legal requirement?

Not by name. No regulation says "you must audit". What the law does require is the thing an audit delivers.

Regulation 5 of the Management of Health and Safety at Work Regulations 1999 says every employer must make and give effect to arrangements for the "effective planning, organisation, control, monitoring and review" of their preventive and protective measures. The arrangements must be appropriate to the nature of the work and the size of the business, and with five or more employees they must be recorded.

So monitoring and review are legal duties. How you carry them out is up to you. HSE describes the approach as Plan, Do, Check, Act, and says that for most small, low-risk businesses a formal management system is not needed. Its guidance on managing for health and safety, HSG65, says that in some circumstances formal audits may be useful.

In practice there are two other reasons small firms audit. Customers and accreditation schemes ask for evidence that you check your own arrangements. And a formal management standard such as ISO 45001, if you choose to be certified to it, involves being audited against it.

How a small firm can audit itself

1. Pick the auditor. The best person is someone who knows the business but is not checking their own work: a director auditing the area the works manager runs, or two managers auditing each other. In a very small firm the owner does it, and the discipline is to look for evidence and not rely on what you believe is happening.
2. Set aside the time. Half a day, in the diary, once a year. Choose a normal working day, not a quiet one.
3. Use three kinds of evidence. Read the documents. Go and look. Ask people. A statement on the checklist is only "yes" if you have seen something that shows it.
4. Sample. You cannot check every record. Pull three training files, three risk assessments and the last three accident reports, chosen at random, and follow each one through.
5. Answer each line yes, partly or no, and write a few words on what you saw. "Partly" with a note is more useful than a generous "yes".
6. Ask the people doing the work. Where is the first aid box? What would you do if the guard was missing? Who do you tell about a near miss? Their answers tell you whether the system has reached them.
7. Write it up on one page. What is working, what is not, and what will be done.

Health and safety audit checklist

Each line is written as a statement that is true when all is well. Some lines are legal requirements and some are good practice, such as reviewing the policy every twelve months. Strike out anything that does not apply to your work, and add lines for risks that are particular to you.

Policy and organisation

• A competent person has been appointed to help with health and safety, and has the time to do it
• The health and safety policy is in writing, signed, dated and reviewed within the last 12 months
• The people named in the policy still work here and still hold those responsibilities
• Every employee has been shown the policy and knows where to find it
• Employees are consulted on health and safety, and there is a note of when it last happened
• The health and safety law poster is displayed where people can read it, or every employee has the leaflet
• The current employers' liability insurance certificate is displayed or available to employees electronically
• Contractors are checked for competence and briefed on site rules before they start

Risk assessment

• There is a risk assessment for each significant activity, with the significant findings written down
• Each assessment is dated and has been reviewed since the last change to the work, the equipment or the people
• The controls written in three assessments chosen at random are the controls in use on the job
• People doing the work know what the assessment says about their job
• The assessments take account of anyone at particular risk, such as young workers and new or expectant mothers
• COSHH assessments exist for the hazardous substances in use, and the safety data sheets are to hand
• Assessments have been looked at again after every accident and near miss

Training

• There is a written list of the training each role needs
• Every new starter in the last year had a health and safety induction, and there is a record of it
• Every person's required training is in date, with nothing expired
• People who changed job or began using new equipment were trained before they started
• Training records show the course, the date, the provider and the expiry date
• Supervisors know who is not yet trained for which tasks
• Toolbox talks or briefings have been held and attendance recorded

Incidents

• People on every shift and site know how to get an accident or near miss recorded
• Every accident in the last year has a written record showing a cause and an action
• Near misses are being reported as well as injuries
• Each incident was checked against RIDDOR, and anything reportable was reported within the time limit
• Injuries that kept someone from normal work for more than three days are on record
• Accident records are stored where only those who need them can read them, and kept for at least three years
• Actions arising from past incidents have been completed

Equipment and checks

• There is a list of equipment that needs inspection or examination, with the date each is next due
• Lifting equipment has a current report of thorough examination
• Local exhaust ventilation has been examined and tested within the last 14 months
• Guards and safety devices are fitted and in use on the machines looked at today
• Pre-use checks on lift trucks and vehicles are being done and recorded, and ladders are checked by the user before use, with their detailed inspections recorded
• Defects reported in the last three months were repaired, or the equipment was taken out of use
• Portable electrical equipment is checked for damage, and damaged items have been removed
• PPE is available, in good condition and being worn where it is required
• Regular workplace inspections are being carried out and their findings dealt with

Fire and first aid

• The fire risk assessment is written down and has been reviewed in the last 12 months or since the last change to the premises
• Escape routes and fire exits are clear and can be opened
• The fire alarm, emergency lighting and extinguishers have been tested and serviced as the fire risk assessment requires, and it is recorded
• A fire drill has been held and recorded in the last 12 months
• Two people asked at random know what to do when the alarm sounds and where the assembly point is
• First aid needs have been assessed
• First aid kits are stocked, in date and where people expect to find them
• An appointed person or first aider is available whenever people are at work
• First aiders' certificates are in date
• Employees have been told who the first aiders are and where the kit is

Welfare

• Toilets and washbasins are clean, with hot and cold or warm water, soap and a means of drying hands
• Drinking water is available
• There is somewhere to rest and to eat meals
• There is somewhere to store clothing, and to change where special clothing is worn
• The workplace is at a reasonable temperature, with adequate ventilation and lighting
• Floors and traffic routes are in good repair and free of obstructions
• The workplace is clean and waste is removed regularly

Documents

• There is one list of the documents the business should hold, and none is missing
• Every document has a review or expiry date, and none is overdue
• Superseded versions have been archived, so only the current one is in use
• Employers' liability certificates from earlier years have been kept
• RIDDOR records go back at least three years
• Health surveillance records, where they are required, are being kept
• If the business is responsible for the building, the asbestos assessment and management plan are in place
• Every action from the last audit has been closed

What to do with the findings

An audit that ends in a filed checklist has achieved nothing. The value is in what happens next.

1. Sort the findings by risk. A missing guard is today. An unsigned policy is this month.
2. Turn each one into an action with a name and a date. "Review risk assessments" is a wish. "Sam to review the three forklift assessments by 30 November" is an action.
3. Look for the reason behind repeated findings. If training keeps lapsing, the problem is not the people whose tickets expired. It is that nothing warns you beforehand.
4. Tell your employees what you found. Talking the findings through is part of consulting them, and they will have views on the fixes.
5. Update the policy and risk assessments where the audit showed they no longer describe what happens.
6. Keep the audit. Next year's starts by checking this year's actions. Our guide to health and safety documents covers what else to hold and for how long.

When to use an outside auditor

A self-audit works when the person doing it is prepared to find fault. It has limits. You cannot easily spot what you do not know to look for, and people are slower to tell the owner what is wrong than to tell a stranger.

Consider an outside audit when the work is high risk, after a serious accident, when a customer or scheme requires independence, or every few years as a check on your own. If you bring someone in, the same advice applies as for any consultant: HSE's guidance is that they should know your industry, visit the workplace and give practical advice on the significant risks. See choosing a competent person or consultant.

Keeping it in SafetyPro360

In SafetyPro360 you can build this audit as a checklist with your own questions under Inspections and checks. You run it on a phone or a computer, answer each question and add a comment where needed. Each completed check is kept with its date, who did it, the site and a score, so last year's audit is there to compare. Findings can be set up as actions with a person, a priority and a due date, and overdue actions are flagged. Checks are not scheduled automatically: you decide when to run one. The dashboard lists what is overdue, missing or expiring when you log in.

Questions people ask