How to conduct a WHS audit: a step-by-step guide

To conduct a WHS audit, plan the scope and checklist, collect evidence through site inspections, interviews and document checks, write up each finding with the evidence behind it, and then assign and track the fixes. Repeat the cycle on a schedule. An audit is only worth doing if the findings lead to changes on site.

This guide walks through each step, with a checklist of what to look at and the evidence to collect. It's written for the safety officer, the site supervisor or the owner who has been asked to "do an audit" and wants to know where to start.

What a WHS audit checks

A WHS audit is a structured review of your safety systems. It answers two questions:

• Are we meeting our duties? The primary duty of care in section 19 of the WHS Act requires a PCBU to ensure health and safety so far as is reasonably practicable. An audit checks the records, controls and training that show you're doing that.
• Do the controls work in practice? A policy on the shelf doesn't stop a fall. An audit checks what people actually do on site.

Audits also support officers' due diligence under section 27 of the WHS Act. Officers need to know the business's main risks and check that the resources and processes for managing them are in place and being used. A dated audit with follow-up is good evidence of that.

Internal or external audits

An internal audit is run by your own people, such as a WHS coordinator, a trained supervisor or a manager from another site. It's cheaper and can be done often. The risk is that people auditing their own work miss things, so give the audit to someone who doesn't run the area.

An external audit is run by an independent assessor. Clients, principal contractors and certification bodies often ask for one. Many businesses use both: internal audits through the year and an external check each year or two.

Step 1: Plan the audit

Write down four things before you start:

1. Scope. Which sites, activities or systems are in the audit? A single job, a yard, or the whole management system?
2. Standard. What are you checking against? Your WHS management plan, your SWMS and procedures, the WHS Regulations and any codes of practice, or ISO 45001 if you're certified.
3. Schedule. Set the dates, tell the people who will be audited, and book time with the crews.
4. Checklist. Use a checklist so every auditor checks the same things. A workplace inspection checklist covers the site basics, and an internal audit plan sets out the whole program.

Step 2: Collect evidence

Good audits gather evidence from three places. Use all three, because each one catches gaps the others miss.

• Walk the site. Look at the work as it happens: barricades, guarding, plant pre-start checks, chemical storage, housekeeping and whether workers wear the right PPE.
• Talk to workers. Ask the people doing the job how they do it and what gets in the way. Ask what they'd change. Workers often know about a hazard long before it reaches a report.
• Read the records. Check inductions, training, SWMS and sign-on sheets, maintenance logs, incident and hazard reports, and whether reviews happened when they should have.

The table below shows what to check in common areas and the evidence that proves it.

Record what you see as you go. Notes taken on the spot are more reliable than notes written up at the end of the day.

Step 3: Write up the findings

Each finding should say:

• What you saw in plain words, such as "Two ladders in Bay 3 have no inspection tags."
• The requirement it falls short of, such as your SWMS, a procedure or the law.
• The evidence, such as a photo, a record or the name of the worker you spoke to.
• How serious it is, based on the likely harm and how many people it affects.
• A recommended fix, with a suggested owner and due date.

Keep the report short enough that a site supervisor will read it. Group findings by area, and lead with the ones that could cause serious harm. For a standard way to write up a problem and its fix, see how to create a non-conformance report that drives improvement.

Step 4: Assign and track the fixes

An audit ends when the fixes are done and checked, not when the report is issued. For each finding:

1. Assign one named person to fix it.
2. Set a due date that matches the risk.
3. Log it in your corrective actions register, so it can't disappear.
4. Check the fix on site and record that you checked it.
5. Review the open list at your next safety meeting, and track the results over time with a few health and safety KPIs.

Where a finding shows that a control isn't working, review that control. Under regulation 38 of the model WHS Regulations, a control must be reviewed when it isn't working, before a change at the workplace, when a new hazard appears, when consultation shows a review is needed, or when a health and safety representative asks. A finding can be one of those triggers. For more on when and how to review controls, read why reviewing your risk controls matters.

Step 5: Involve workers

The duty to consult workers in section 47 of the WHS Act applies to audits too. Tell workers when the audit is on, invite them to join the walk, and share the results with the crew before the report goes to management. Workers who see their concerns acted on are more likely to report the next one.

Common mistakes

The audit is a paper exercise. If the auditor only reads the documents, the audit checks the paperwork, not the site. Always walk the work.

The auditor marks their own homework. A supervisor who audits the crew they run will miss what they've stopped noticing. Rotate auditors or bring in someone from outside the area.

The findings are never closed. A report that sits in a folder fixes nothing. Track every action to closure and check it on site.

Only the bad news is written down. Record what's working as well. It tells you what to keep doing, and it shows the audit looked at the whole system.

Workers aren't asked. Frontline workers often see the gap between the policy and the job first. Leave them out and the audit misses it.

How SafetyDocs helps

SafetyDocs gives you the checklists, audit reports and corrective action registers to run audits from one place. Job, client and site details fill themselves in, and each job's activity log is a dated record of posts, photos, issues, and who read and signed what. When a document changes, everyone who signed is asked to sign the new version. That record helps you show that audits were done and that the fixes were checked, but it doesn't make your business compliant on its own.

Common questions

How often should I audit? Set a schedule that matches your risk. Many businesses audit high-risk sites more often than low-risk offices, and review the whole management system at least once a year. Your regulator and any certification you hold may set minimum frequencies.

Who should do the audit? Someone trained and independent of the work being checked. For certification or high-stakes audits, use an external assessor.

What's the difference between a compliance audit and an operational audit? A compliance audit checks that the required documents and systems exist. An operational audit checks whether they work on site. Do both, because a system can look complete on paper and still fail in practice.

What should I do if an audit finds a serious hazard? Make the area safe straight away, stop the work if it's needed, and report it to your supervisor. Don't wait for the report to be written. If the event meets the definition of a notifiable incident, it has its own reporting duty.

This is general information, not legal advice. Check the current law with your WHS regulator.