Few practitioners would argue about the need to periodically audit their organisation’s health and safety management systems, so why is the process often given a low priority in company health and safety plans? Helen Toll explores the benefits of, and barriers to, auditing, and argues that we should be starting with the end in mind.
The term ‘audit’ is often used somewhat loosely to describe health and safety monitoring activities, ranging from inspections, surveys, and health and safety tours through to table-top exercises. These all form part of the routine measurement of health and safety performance, but they do not necessarily provide an objective assessment of all elements of the health and safety management system — as auditing aims to.
The HSE1 suggests that the aims of audit should be to establish that: appropriate management arrangements are in place; adequate risk-control systems exist, are implemented, and run consistent with the hazard profile of an organisation; and appropriate workplace precautions are in place.
Auditing, then, differs from other forms of health and safety monitoring in that it is proactive, planned, and systematic. Plus, it is generally carried out by individuals with a degree of independence from the management structure and activities of the area of business under scrutiny.
Are health and safety audits obligatory?
It could be argued that there is a legal imperative to carry out periodic health and safety auditing — how else can an organisation ensure, so far as is reasonably practicable, the health and safety at work of employees and others?
Also, the Management of Health and Safety at Work Regulations 1999 require employers to have arrangements for the effective planning, organisation, control, monitoring, and review of preventive and protective measures.
So, if auditing is a legal requirement, why hasn’t more enforcement action been taken to encourage employers to engage in this important management activity? Most of the encouragement seems to have been focused on guidance rather than enforcement.
The Turnbull guidance,2 which aimed to improved the standards of risk management and internal control of listed UK companies and registered charities, states: “Directors should, at least annually, conduct a review of. . . systems of internal control. . . The board cannot rely solely on the embedded monitoring processes within the company to discharge its responsibilities.”
Meanwhile, the HSC/Institute of Directors guidance3 for board members gives the following steer: “Larger public and private-sector organisations need to have formal procedures for auditing and reporting health and safety performance. The board should ensure that any audit is perceived as a positive management and boardroom tool. It should have unrestricted access to both external and internal auditors, keeping their cost-effectiveness, independence and objectivity under review.”
A variety of individuals and groups might have a vested interest in the health and safety performance of an organisation, and the effectiveness of its health and safety management systems. Internal stakeholders might include senior management, occupational health and safety professionals, employee representatives, internal audit functions, or the parent company itself. The list of external stakeholders has expanded in recent years beyond regulators and insurers to include investors, supply-chain customers, and end-users looking for evidence of corporate social responsibility.
Benefits
Auditing will provide the necessary information and assurances for the key stakeholders referred to above. An effective audit will identify the level of legal compliance and potential liability of the organisation, and provide an independent check that risks are effectively being managed and systems are working. The process can either establish a baseline on which to build, or provide a measure of improvement since the last audit, or a benchmark with other sites or external organisations.
An essential stage of attaining or maintaining third-party accreditation, audits are conducted to check if a specified standard, such as OHSAS 18001, has been met. It could be necessary to use audit techniques to measure safety culture maturity or readiness, prior to implementing a new safety initiative, such as a behaviour-based safety programme. On a more cynical note, some audits have an unofficial aim — such as to justify an imminent change, e.g. the outsourcing of a service, which may or may not be a forgone conclusion!
As a proactive management tool, auditing identifies system weaknesses before accidents occur, and the information obtained can be used to develop plans for improving health and safety performance. The existence of a robust health and safety auditing programme should also provide a degree of mitigation in the event of a corporate manslaughter case, providing the organisation has acted on the findings and recommendations in a timely manner.
Adopting a balanced approach to auditing will also provide positive feedback and recognition of good management and best practice, while the process can help raise awareness and improve employee participation and morale by demonstrating senior management commitment to health and safety. On an individual level, participants can benefit considerably by developing new skills and a greater depth of understanding of health and safety management.
Barriers
So, with so many obvious benefits to auditing, why don’t organisations prioritise this activity? Anyone with any experience of auditing will be only too aware of how resource-intensive the process can be, at all stages — from planning and preparation, gathering evidence (document review, interviewing and observation) through to providing feedback, writing reports, and following up action plans.
Another barrier might be that the organisation simply has no system for conducting health and safety audits, and the health and safety team might feel they have insufficient expertise, resources, or time to focus on auditing, as they are too busy ‘fire-fighting’. There could be a perception that it is not the right time to conduct an audit, owing to organisational change, staff turnover, or the implementation of other initiatives, which would compete for resources, and lead to fear of ‘audit overload’. For example, many organisations prioritise the attainment of ISO 14001 because of its perceived commercial advantages, leaving health and safety teams little choice but to put OHSAS 18001 on the back burner.
Auditing could also be considered inappropriate if the health and safety management system is still in development, as the process will only reveal shortcomings that the organisation is already aware of, and attempting to address. It might be felt that close scrutiny will only open a proverbial ‘can of worms’ and generate too many expectations, derailing the existing action plan.
What health and safety standard should you audit against?
One of the challenges faced when first considering an audit programme is deciding what standard and criteria to audit against.
Options include using straightforward requirements as the audit criteria; a certifiable standard, such as OHSAS 18001; or a management system model such as HSG65. Alternatively, and more commonly, internal performance standards or policies, which are often based on one of the above, will be used as the criteria.
When deciding on what standards to audit against, there are some fundamental questions to consider:
If you are going to audit against internal policies, do they cover all applicable health and safety legal requirements and all significant risks?
Does your organisation have a health and safety management performance standard, which clearly identifies what health and safety systems and documentation each department should have in place?
Are your standards up to date, and detailed in controlled documents?
Have these standards been communicated to all managers and relevant staff in your organisation?
Have you provided guidance and training for managers to accompany your performance standards?
For a performance standard to be adequate it must identify who is ultimately accountable, and who is responsible for doing what. It should also give details about the necessary resources and levels of training, how and when these activities should take place, and what outputs are expected.2
Writing technically and legally perfect health and safety policies may impress the regulator, and provide reassurance for the health and safety team that all bases are covered, but do those policies provide a performance standard that can be audited, and which guides managers and supervisors through the maze of day-to-day health and safety management?
Some organisations have designed their health and safety management standards with auditing in mind from the start. Such businesses have written policies or standards as a series of statements, which reflect performance at varying levels (e.g. from poor to excellent, bronze to gold, etc). Each statement is then translated into one or more audit questions. The statements describe the basic standard to be achieved, together with aspirational performance levels, while the questions aid the processes for both departmental self-auditing and corporate auditing.
Choosing a health and safety audit system
The options an organisation can choose from when deciding on its approach to audit each have their own strengths and weaknesses. Developing an ‘in-house’ audit system and your own audit question sets has the distinct advantage that the system will be relevant to the work activities, structure and culture of your organisation, and can be modified easily and quickly at no extra cost. It might, however, be time-consuming to develop, lack objectivity, and be dependent on the experience and knowledge of the developer.
Using ‘off-the-shelf’ audit systems, which use standard question sets, should provide a reliable and comprehensive methodology, as the system should be based on a published health and safety model or standard. This option will enable benchmarking with other organisations using the same system, and will usually be supplied with software to facilitate data entry, analysis, and reporting. The downside is that the system may not adequately reflect the size, arrangements, and specific risks of the organisation. The standards prescribed might also be inappropriate, or too broad in approach, or even too complex or bureaucratic for the organisational culture.
To overcome these challenges, some sectors, such as the University Safety & Health Association,4 have grouped together to develop a management standard and audit system specifically tailored to their needs. Another option is to enlist the help of external consultants or auditors to develop an internal audit system.
Using self-audit questionnaires, which are designed by health and safety professionals but completed by line managers for their department (or issued by the parent organisation to each site), can provide a useful and cost-effective interim step to complement a full audit programme. Self-audits enable a department to assess their own health and safety performance against predetermined standards, and often encourage the development of local action plans to address any deficiencies identified.
The obvious disadvantage of this approach is the lack of verification, although a sample of questionnaire returns can be selected for checking. It is important that recipients are provided with sufficient guidance to understand the audit questions, which must be written in plain English, as the opportunity to check understanding face to face will not be available.
The temptation to try to cover every single aspect of health and safety should also be resisted. A focus on just a few aspects of health and safety management during each annual audit, for example, would provide a more manageable task, and could be aligned with the current corporate priorities.
Auditor competence
As important as the audit system are the skills of individual auditors, who need to be adequately trained and competent in the chosen audit methodology. Auditors should possess a sound understanding of health and safety management systems, theory and standards, and have relevant experience in risk assessment and identifying suitable controls. They need a broad vision of improvement opportunities, including knowledge of best practice and external benchmarks.
Well-developed analytical and investigation skills are needed so they can quickly collect reliable evidence and examples to support findings and recommendations. Communication skills, such as the ability to interview effectively using appropriate questioning and listening techniques, and clear, accurate report-writing, are all essential.
Auditors need to overcome what seems to be a human instinct to focus on what’s wrong and what’s missing, and ensure they also identify strengths, examples of good practice, and provide positive feedback, where appropriate.
To be fully effective, auditors need to be independent and objective. They should have no personal accountability or direct reporting relationships within the group or area being audited, to avoid conflicts of interest. Maintaining independence can be a particular challenge for internal auditors, who may also more readily accept a status quo they have helped build.
Developing a standard audit protocol to plan, organise, and conduct the audit can help reduce workload for internal auditors, and ensure greater consistency and audit validity.
Conclusion
The benefits to both internal and external stakeholders of effective health and safety auditing are compelling. Audit is essential to demonstrate robust corporate governance, while being an implicit legal requirement, albeit seldom enforced.
Managers at all levels of an organisation should know what health and safety management systems need to be operating in their departments, what corresponding documentation they should be keeping and why, and be provided with a transparent performance standard to guide the daily management of health and safety risks. A well-designed and proportionate self-audit can provide interim milestones to complement a full audit programme, which should only be conducted by sufficiently independent and competent auditors.
Far from being the last item in the health and safety action plan, the design of audit systems should start from day one, in parallel with the design of the health and safety management system itself.
Most of us are familiar with the saying: “If you don’t know where you are going you will probably end up somewhere else!”5 If health and safety management standards are your map, and accreditation is your destination, then audit is your compass — remember to pack it before you start your journey!
References
1 HSE (1997): Successful health & safety management HSG65, ISBN 0 71761 2767, HSE Books
2 Institute of Chartered Accountants in England and Wales (1999): Internal control: Guidance for directors on the Combined Code
3 Health and Safety Commission/Institute of Directors (2007): Leading health and safety at work — Leadership actions and good practice for board members, INDG147, HSE Books
4 University Safety & Health Association (2003): Health and safety management performance standards
5 Peter, L and Hull, R (1994 edition): The Peter Principle: Why things always go wrong, Souvenir Press Ltd
6 BS OHSAS 18001:2007 — Occupational health and safety management systems — Requirements, BSI
7 Mattsson, B and Olsson, P (2001): ‘Environmental audits and life-cycle assessment’, in Auditing in the food industry — From safety and quality to environmental and other audits, Woodhead Publishing
Helen Toll works as a consultant for Norwich Union Risk Services.
The Safety Conversation with SHP (previously the Safety and Health Podcast) aims to bring you the latest news, insights and legislation updates in the form of interviews, discussions and panel debates from leading figures within the profession.
Find us on Apple Podcasts, Spotify and Google Podcasts, subscribe and join the conversation today!
