What Is A Safety Audit?

What is a safety audit?

A safety audit is a systematic, documented evaluation of an organisation's safety management system against defined audit criteria, such as legislation, a Code of Practice, or a standard like ISO 45001.

It examines evidence rather than impressions.

An auditor tests three things: that a control is documented, that it is being used, and that it is working.

A policy on paper with no training records behind it is a finding, even where nobody has been hurt.

Audits are evidence-driven because their output has to withstand external scrutiny. A regulator, insurer or client reviewing your safety performance wants records, not assurances. Understanding the difference between hazards and risks matters here, since auditors assess how well you have controlled risk, not simply whether hazards are present.

Safety audit vs safety inspection: what is the difference?

A safety audit evaluates the system that manages risk, while a safety inspection checks physical conditions at a point in time. Both are useful, and they answer different questions.

An inspection asks whether the guard is fitted. An audit asks whether your machinery risk assessment identified the need for a guard, whether someone was assigned to fit it, and whether the check is scheduled to recur. Audits also examine hazards that leave no physical trace, which is why a psychosocial risk assessment usually forms part of audit scope.

Are safety audits legally required in Australia?

Australian WHS law requires every PCBU to eliminate or minimise risks so far as is reasonably practicable, and a safety audit is the standard method of proving that duty has been discharged. The legislation sets the outcome, and leaves the method to you.

Audits become mandatory in several practical situations: ISO 45001 certification requires them, most principal contractor prequalification schemes require them, and many insurance and tender conditions require evidence of a recent audit.

Officers carrying PCBU health and safety obligations also rely on audit findings to demonstrate the due diligence expected of them.

How requirements differ by state

Duties are broadly consistent nationally, with differences in the governing instrument and regulator:

• Harmonised states. All jurisdictions except Victoria apply the model WHS Act framework.
• Victoria. Operates under the Occupational Health and Safety Act 2004, with equivalent duties.
• Codes of Practice. Each regulator publishes its own, which become the practical audit criteria.
• Psychosocial duties. Dates vary, so check psychosocial hazards legislation by state.

What are the main types of safety audit?

Safety audits fall into five recognised types, distinguished by what they measure and who performs them. Choosing the wrong type is the most common reason an audit produces findings nobody acts on.

The five types you are likely to encounter:

• Compliance audit. Tests conformance with legislation, regulations and applicable Codes of Practice.
• Systems audit. Reviews whether the whole safety management system is designed and functioning correctly.
• Process audit. Examines one activity or site, such as contractor or confined space management.
• Verification audit. Confirms corrective actions from a previous audit were completed and remain effective.
• Certification audit. Performed by an accredited body against ISO 45001 for formal certification.

Psychological health sits inside these types rather than beside them. ISO 45003 provides the guidance most auditors now use when setting psychosocial audit criteria.

Who should conduct a safety audit?

Internal auditors suit routine system checks, while external auditors are appropriate for certification, high-risk operations and any audit whose findings will be read by a third party. Independence is the deciding factor.

Choose your auditor based on what the report needs to withstand:

• Internal safety personnel. Fast, low cost, strong operational knowledge, limited independence.
• Health and safety representatives. Add worker perspective and improve engagement with findings.
• External consultants. Independent, benchmarked against other sites, suited to certification.
• Regulators. Attend on their own terms, often following an incident or complaint.

A regulator visit follows different rules to a commissioned audit, which is covered in what is a SafeWork audit.

How to conduct a safety audit in five steps

A defensible safety audit follows a fixed sequence: define scope, gather evidence, verify on site, rate findings, then track corrective actions to closure. Skipping the final step is what turns an audit into paperwork.

1. Define scope and audit criteria

Name the sites, activities and hazard classes in scope, and state the criteria you are auditing against. Vague scope produces findings nobody owns.

2. Gather documents and data

Collect policies, risk registers, training records, incident reports, maintenance logs and previous audit findings. Review them before setting foot on site.

3. Verify on site

Observe work as it happens, interview workers at multiple levels, and test whether documented controls match practice. Physical and psychosocial hazards both need direct evidence.

4. Rate and record non-conformances

Document each finding with evidence, then rate it by risk so corrective actions can be prioritised. Photographs and direct quotes strengthen the record.

5. Report and close out actions

Assign each action an owner and a due date, then verify completion. Open actions carried between audits are a finding in their own right.

How often should safety audits be done?

Most Australian workplaces run a full safety audit annually, with higher-risk operations moving to six-monthly and adding targeted audits after significant events. Frequency should track risk, not the calendar.

Trigger an additional audit when any of these occur:

• After a serious incident. Particularly a notifiable incident or a cluster of near misses.
• New plant or processes. Any change introducing hazards your current controls miss.
• Restructures. Workload, role clarity and reporting line changes create new psychosocial risk.
• Before certification or tender. Where an external party will review your safety performance.

Smaller businesses can run a lighter cycle using a small business health and safety checklist between formal audits.

Do safety audits cover psychosocial hazards?

Yes. Psychosocial hazards are regulated hazards under Australian WHS law, and an audit that examines only physical risk leaves a material gap in the assessment. Auditors increasingly ask for the same standard of evidence they would expect for plant or chemicals.

Psychosocial controls are harder to evidence because the hazards produce no physical trace. Auditors look for a psychosocial risk register, survey or consultation data, documented controls for hazards such as high job demands and poor role clarity, and records showing findings were acted on.

FAQs

What is included in a safety audit checklist?

A safety audit checklist lists the criteria being tested, the evidence required, and space to record findings and ratings. Typical sections cover policy and governance, risk registers, training and competency, incident reporting, emergency procedures, contractor management, plant and equipment, and psychosocial risk. Checklists should be built from the standard or legislation you are auditing against.

What is the difference between a safety audit and a risk assessment?

A risk assessment identifies hazards and decides on controls. A safety audit checks whether those controls were implemented and are working. Risk assessment happens before the control exists, and audit happens after. Most audits will review your risk assessments as one source of evidence, which is why out-of-date registers are a common finding.

What happens after a safety audit?

The auditor issues a report listing each non-conformance, its risk rating, and a recommended corrective action. Management assigns an owner and due date to each item, then tracks them to closure. A verification audit or follow-up review confirms actions were completed and effective. The closed-out report becomes part of your due diligence record.

Can a business fail a safety audit?

Certification audits against ISO 45001 can result in a failed outcome where major non-conformances are raised and not resolved within the required timeframe. Internal and consultant audits do not usually pass or fail. They produce findings rated by severity, and the meaningful measure is how quickly high-risk findings are closed.

How do you prepare for a safety audit?

Collect your evidence before the auditor arrives: policies, risk registers, training records, incident reports, maintenance logs and previous corrective actions. Close any outstanding actions from the last audit, since carried-over items attract attention. Brief managers and workers that they may be interviewed, and make sure records are accessible rather than scattered across drives.

Do small businesses need to do safety audits?

Small businesses carry the same duty to manage risk as large ones, so some form of systematic review is expected. Audits can be proportionate: a low-risk single-site business may need only a short annual self-audit. Contractual and prequalification requirements often set the real standard.

Foremind helps Australian organisations turn psychosocial safety obligations into evidence they can put in front of an auditor. Learn more about Foremind.

‍