Health and Safety Audits: What They Are, How to Run One and How They Differ From Inspections

A health and safety audit is a systematic, independent check of whether an organisation’s health and safety management system is in place, working and effective. It is part of the “check” and “act” stages of Plan, Do, Check, Act, and it is a requirement of ISO 45001, where clause 9.2 requires internal audits at planned intervals.

Audit or inspection?

Both matter. Our guide to site safety inspections covers the inspection side.

The stages of an audit

1. Plan. Agree the scope, criteria, auditor and dates. Criteria might be the law, your own procedures or ISO 45001.
2. Prepare. Review the policy, risk assessments, previous audits and incident data. Prepare a checklist or question set.
3. Open. Hold a short opening meeting to explain the process.
4. Gather evidence. Use three sources: documents and records, interviews with people at all levels, and observation of work and the workplace.
5. Evaluate. Compare the evidence with the criteria and decide on findings: conformities, nonconformities and opportunities for improvement.
6. Close. Present the findings in a closing meeting so there are no surprises in the report.
7. Report. Write clear findings with evidence and priorities.
8. Follow up. Agree actions, owners and dates, and check they are completed.

What auditors typically look at

• Policy, leadership commitment and responsibilities
• Competent advice, such as the competent person appointment
• Risk assessments and whether they reflect real work
• Training records and competence
• Contractor management
• Emergency arrangements, including fire and first aid
• Inspection, maintenance and statutory examination records
• Incident reporting and investigation
• Consultation with workers
• Monitoring, review and performance indicators

Getting value from an audit

• Check what happens in practice, not just what is written down
• Speak to workers as well as managers
• Score consistently, so results can be compared over time
• Focus actions on the root cause of findings, not just the symptom
• Report results to senior management and track actions to closure

Internal or external?

Internal audits are carried out by your own trained staff, which builds understanding but can lack independence. External audits by consultants or certification bodies add fresh eyes. ISO 45001 certification involves external audits by an accredited certification body. ISO 19011 gives guidance on auditing management systems.

Training that helps

The NEBOSH National General Certificate covers auditing and monitoring as part of managing health and safety, and the Level 6 NVQ in Occupational Health and Safety includes evaluating and improving systems. For leaders, IOSH Leading Safely explains how to use audit findings.

Frequently asked questions

What is the difference between a health and safety audit and an inspection?

An inspection checks physical conditions and behaviour. An audit checks whether the whole management system is in place and effective.

How often should a health and safety audit be done?

There is no fixed legal frequency. Most organisations audit at least annually, and ISO 45001 requires internal audits at planned intervals.

Is a health and safety audit a legal requirement?

The law requires employers to monitor and review their arrangements, and audits are a recognised way to do this. ISO 45001 certification requires them.

Who can carry out a health and safety audit?

Someone trained in auditing and independent of the area being audited, either internal or external.

Read the source

HSE HSG65, Managing for health and safety; ISO 45001:2018, clause 9.2; ISO 19011:2018, Guidelines for auditing management systems; and the Management of Health and Safety at Work Regulations 1999, regulation 5. Facts checked on 6 October 2026.