Your safety policy is up to date. Your procedures are documented. Your audit checklist is ready.
Then you walk onto the floor and realize the process everyone is supposed to follow is not quite the process anyone actually follows.
That is the real purpose of a health and safety audit: finding out what is happening beyond the paperwork.
The stakes are serious. The ILO’s latest safety and health data estimates that 2.93 million workers die each year from work-related factors, while 395 million sustain a non-fatal work injury each year.
A good audit helps you identify where policies, processes, controls, and reporting systems are working, where they are falling short, and what needs to happen next.
Part 1: Know What You’re Auditing
Before you build a checklist, get clear on what you are actually trying to find out. A health and safety audit is not just a search for missing signatures, expired documents, or boxes that have somehow remained unchecked since 2022.
The real question is whether your safety management system is working as intended.
Why Does a Health and Safety Audit Matter?
A safety procedure can be perfectly written and still not be followed on the floor. Training can be completed without employees fully understanding the risks. Corrective actions can be marked “closed” while the same problem shows up again a few months later.
A good workplace safety audit closes that gap by comparing what your system says should happen with what is actually happening.
That is consistent with the approach behind ISO 45001’s occupational health and safety framework, which covers areas such as hazard identification, worker participation, legal requirements, emergency preparedness, incident investigation, auditing, and continual improvement. ISO 45001:2018 remains the current published standard, although a revised version is now under development.
So instead of asking only:
“Do we have a safety procedure?”
Ask:
“Is the procedure understood, followed, monitored, and improved when it is not working?”
That shift makes the audit much more useful.
What Does a Health and Safety Audit Cover?
The scope will depend on your workplace, risks, legal requirements, and audit objectives. But a practical safety management system audit should usually examine:
- Policies and procedures: Are they current, approved, accessible, and actually followed?
- Risk management: Are hazards identified, assessed, and controlled effectively through a workplace risk assessment?
- Training and competence: Are required training records current, and can employees demonstrate what they have learned?
- Workplace controls: Are PPE, equipment, maintenance, emergency arrangements, and other controls working as intended?
- Incidents and near misses: Are they consistently reported, investigated, and used to prevent recurrence?
- Worker participation: Are employees involved in identifying hazards and improving safety?
- Corrective actions: Are previous findings actually resolved, and has their effectiveness been verified?
- Reporting and performance: Can management see recurring issues, trends, and areas that need attention?
The evidence should come from more than documents. Look at records, observe the work, talk to employees, and compare the evidence with your audit criteria. Otherwise, you may end up auditing the safety management system entirely from behind a desk, which is a little like checking whether a fire extinguisher works by reading its label.
In short: audit the system, the workplace, and the people using the system. That is how you find out whether your safety processes are genuinely working, rather than simply looking organized on paper.
Part 2: How to Conduct a Health and Safety Audit
A good safety audit process should be structured, evidence-based, and practical. You want to find out what is actually happening, not spend three hours admiring how well-organized the documentation is.
1. Define the Scope and Audit Criteria
Decide what you are auditing, why, and what you will assess it against.
Consider:
- Scope: Site, department, process, or entire safety management system?
- Purpose: Compliance, certification, recurring incidents, or improvement?
- Criteria: Company procedures, legal requirements, ISO 45001, or customer requirements?
- Auditor: Does the person have the right competence and enough independence?
If ISO 45001 is one of your audit criteria, your existing management-system processes can provide a useful starting point for assessing requirements, documentation, risk controls, worker participation, and internal audits. Preparing for an ISO 45001 audit using QMS can help organizations approach that process more systematically.
A risk-based approach helps you focus on areas where failure could have the greatest consequences.
2. Review Records and Prepare Your Safety Audit Checklist
Before the audit, review the documents that tell you how the system is supposed to work:
- Risk assessments and safety procedures
- Training records
- Incident and near-miss reports
- Inspection and maintenance records
- Emergency plans and drill records
- Previous safety audit findings and open corrective actions
Turn these requirements into a focused health and safety audit checklist. Keep it practical. Every question should help you gather evidence or identify an action.
3. Review, Observe, and Ask
This is where you test the paperwork against reality.
Review records and procedures.
Observe work practices, equipment, PPE, controls, and emergency arrangements.
Ask employees and supervisors how things actually work.
If the procedure says one thing and the workplace does another, you have found something worth investigating.
This combination of document review, workplace observation, and conversations with responsible people is also reflected in HSE guidance on auditing health and safety.
4. Record and Prioritize Safety Audit Findings
Avoid vague findings like “Safety needs improvement.”
Record:
Finding → Evidence → Risk/requirement → Required action
Then prioritize findings according to your organization’s risk criteria. ISO 19011 guidance emphasizes evaluating objective evidence against defined audit criteria, rather than relying on personal opinion.
5. Report the Results and Assign Corrective Actions
Your report should quickly answer:
- What is working?
- What needs attention?
- What action is required?
- Who owns it?
- When is it due?
Discuss significant findings with the relevant managers and teams so everyone understands what needs to change. A good audit report should lead to action, not become another PDF that quietly disappears into a shared drive.
6. Follow Up and Verify Effectiveness
Closing an action does not automatically mean the problem is fixed.
Track the action to completion, collect evidence, and verify that the change actually worked. Then look across previous audits for recurring findings. If the same issue keeps appearing, you may be dealing with a systemic problem, not a one-off mistake.
In simple terms: define the requirements → gather evidence → identify gaps → prioritize findings → assign actions → verify the fix.
Part 2: How to Conduct a Health and Safety Audit
A good safety audit process should be structured, evidence-based, and practical. The goal is to find out what is actually happening, not spend three hours admiring how organized the documentation is.
1. Define the Scope and Audit Criteria
First, decide what you are auditing, why you are auditing it, and what you will assess it against.
Consider:
- Scope: Site, department, process, or entire safety management system?
- Purpose: Compliance, certification, recurring incidents, or improvement?
- Criteria: Company procedures, legal requirements, ISO 45001, or customer requirements?
- Auditor: Does the person have the right competence and enough independence?
A risk-based approach helps you focus on areas where failure could have the greatest consequences. If risks are being managed across multiple processes, risk management software can also provide a more centralized way to manage assessments and related records.
2. Review Records and Prepare Your Safety Audit Checklist
Before the audit, review the documents that show how the system is supposed to work:
- Risk assessments and safety procedures
- Training records
- Incident and near-miss reports
- Inspection and maintenance records
- Emergency plans and drill records
- Previous audit findings and open corrective actions
Significant audit findings should not stop at the audit report. They need to move into a corrective action process, with the root cause identified and effectiveness verified. Connecting audit findings to CAPA shows how to maintain that connection from finding through corrective action and effectiveness verification.
Then turn these requirements into a focused health and safety audit checklist. Keep it practical. Every question should help you gather evidence or identify an action.
3. Review, Observe, and Ask
This is where you test the paperwork against reality.
Review records and procedures. Observe work practices, equipment, PPE, controls, and emergency arrangements. Ask employees and supervisors how things actually work.
For example, if a procedure says employees must report near misses immediately, check the reporting records, ask employees how they would report one, and see whether that process is actually being followed. This combination of reviewing documentation, observing workplace conditions, and speaking with people responsible for the work is also recommended in HSE guidance on health and safety auditing.
If the procedure says one thing and the workplace does another, you have found something worth investigating.
4. Record and Prioritize Safety Audit Findings
Avoid vague findings like “Safety needs improvement.”
Record:
Finding → Evidence → Risk or requirement → Required action
Then prioritize findings according to your organization’s risk criteria. The ISO 19011 auditing guidance emphasizes evaluating objective evidence against defined audit criteria rather than relying on personal opinion.
5. Report the Results and Assign Corrective Actions
Your report should quickly answer:
- What is working?
- What needs attention?
- What action is required?
- Who owns it?
- When is it due?
Discuss significant findings with the relevant managers and teams so everyone understands what needs to change. A good audit report should lead to action, not become another PDF that quietly disappears into a shared drive.
6. Follow Up and Verify Effectiveness
Closing an action does not automatically mean the problem is fixed.
Track each action to completion, collect evidence, and verify that the change actually worked. Then look across previous audits for recurring findings. If the same issue keeps appearing, you may be dealing with a systemic problem, not a one-off mistake.
In simple terms: define the requirements → gather evidence → identify gaps → prioritize findings → assign actions → verify the fix.
Part 3: Make Your Health and Safety Audit Easier to Manage
A good audit should leave you with more than a completed checklist. You need a clear record of what was checked, what was found, what needs to change, and whether the change actually worked.
Use a Health and Safety Audit Checklist That Captures the Right Evidence
A checklist keeps your workplace safety audit consistent without turning it into a box-ticking exercise. For each area, capture the question, evidence, finding, action, owner, and due date.
Your health and safety audit checklist should cover areas such as:
- Safety policies and procedures
- Risk assessments and controls
- Training and competence
- Incident and near-miss reporting
- Emergency preparedness
- Workplace controls and PPE
- Previous audit findings
- Corrective actions and follow-up
Download the Health and Safety Audit Checklist for your next audit.
When Should You Use a Digital Safety Audit Tool?
A paper checklist may be perfectly fine for one small audit. But once you are managing multiple sites, recurring audits, supporting evidence, and a growing list of corrective actions, things can get messy quickly.
A digital safety audit tool can help you:
- Complete checklists and store audit records centrally
- Attach evidence to findings
- Assign corrective actions and deadlines
- Track open and overdue actions
- Review audit history
- Identify recurring findings and trends
- Give management better visibility into safety performance
A digital safety audit tool can make the process easier by helping teams organize audit schedules, checklists, findings, corrective actions, and follow-up activities in one place. Audit management software can provide this structure while making it easier to track the status of audits and follow-up actions.
The goal is not to digitize a checklist just for the sake of it. It is to make the entire safety audit process easier to track from finding → action → verification.
For teams that want to bring these activities into one system, HSE management software can help connect audit activities with other health, safety, and environmental processes.
Conclusion
A safety audit is not a treasure hunt for missing signatures. It is a chance to see whether your safety system actually works when people are doing the job.
Ask the questions, check the evidence, talk to the people doing the work, and follow findings through to verification. If the same problem keeps coming back, your audit has already told you something important.
And if your process currently involves three spreadsheets, five email threads, and someone asking, “Who was supposed to follow that up?”, it may be time for a better system.
Ready to simplify the process? Request a demo.
