External recognition: WCB Safety Certified and COR audits

Eighteen months into the system, Rachel Okoye asked the question every leadership team eventually asks: should Harrowgate Foods Ltd. have its system checked by someone outside the company? Customers had begun asking. Two large grocery chains now included a safety section in their supplier questionnaires, and one asked whether suppliers held an external safety certification. The board wanted assurance that the system was more than a set of binders. And Elena Novak believed that the discipline of an external audit would keep the system honest once the novelty had worn off.

This lesson covers the main forms of external recognition available to Harrowgate Foods Ltd., what each involves, and how to decide whether to pursue them. The aim of external recognition is not the certificate on the wall. It is an independent check, a structured way to find gaps, and a commitment that is hard to quietly abandon.

Three kinds of external check

Organizations in Nova Scotia have three main routes to external recognition of their safety management system. The first is certification to ISO 45001 (or its Canadian adoption, CSA Z45001) by an accredited certification body. The second is WCB Nova Scotia's Safety Certified recognition, earned by passing an approved audit through a certifying partner; for construction employers this is the Certificate of Recognition (COR) program run by Construction Safety Nova Scotia. The third is customer or industry audits, such as the second-party audits large customers carry out on their suppliers.

Certification to ISO 45001

Certification means that an independent certification body, accredited to audit management systems, confirms that the organization's system conforms to ISO 45001 or CSA Z45001. In Canada, the Standards Council of Canada accredits certification bodies; an accredited certificate carries more weight with customers than one from an unaccredited body.

A certification audit has a standard sequence. Many organizations start with an optional pre-assessment, an informal rehearsal that finds gaps before the real thing. The stage 1 audit reviews the system's documentation, the organization's context, its legal register, its readiness and the scope of certification, and plans stage 2. The stage 2 audit, usually a few weeks later, tests implementation and effectiveness on site: auditors interview workers and managers, observe work, sample records and trace processes. Major nonconformities must be corrected before the certificate is issued; minor ones need an accepted action plan.

Once certified, the organization faces surveillance audits, usually once a year, which sample parts of the system, and a recertification audit every three years that reviews the whole system again. Certification is a commitment to be audited year after year, which is much of its value.

What auditors look for

Experienced auditors look for evidence that the system is alive. They ask workers on the floor what the policy means to them, how they report a hazard, what happened the last time they did, and whether they would stop unsafe work. They check whether the hazard register reflects the hazards they can see, whether incidents led to corrective actions that were verified, whether the internal audits found real problems, and whether management review made decisions. A system that looks perfect on paper but whose workers have never heard of it fails quickly.

Recognition programs

In Nova Scotia, WCB Nova Scotia recognizes employers whose safety programs pass an approved audit as Safety Certified. For employers outside construction, the audit is arranged through a certifying partner such as Safety Services Nova Scotia, whose audit tool is built around a set of program elements: among them policy, hazard assessment, inspections, training, investigations, emergency preparedness, committee and representative functions, and return to work. Since January 1, 2024, a return-to-work element has been part of the requirements. Many employers in Nova Scotia pursue Safety Certified because customers, municipalities and other buyers ask for it in tenders and prequalification.

For construction employers, the equivalent is the Certificate of Recognition, or COR, issued by Construction Safety Nova Scotia. COR is widely required to bid on public and large private construction projects in the province, and a COR-holding company is recognized by WCB Nova Scotia as Safety Certified. Certified companies are subject to ongoing maintenance requirements, and Construction Safety Nova Scotia carries out random evaluations of a share of certified companies to check that the certification still reflects practice. Harrowgate is not a construction company, but COR mattered to it in a different way: the contractor prequalification process from lesson 9 accepted COR as evidence of a construction contractor's safety program.

An audit for these programs typically combines three sources of evidence: documentation review, observation of the workplace, and interviews with a sample of workers, supervisors and managers. Each element is scored, and the employer must reach the program's required standard overall and on key elements. The interviews carry real weight: an employer whose documents are flawless but whose workers cannot describe how they report a hazard, or what the emergency plan says, will not do well.

Second-party customer audits

Customer audits sit alongside formal recognition. Large customers increasingly audit suppliers' safety as well as quality, because a serious incident at a supplier can disrupt supply and damage the customer's reputation. Aisha Rahman's food safety team already hosted several customer audits a year, and the two grocery chains asked to add a safety module. Rather than prepare separately for each, Harrowgate Foods Ltd. mapped the customers' questions to its own system and kept a single evidence pack, updated after each management review.

Comparing the routes

Deciding what to pursue

Harrowgate Foods Ltd. weighed the options against what it wanted from external recognition. Customers wanted evidence. The board wanted independent assurance. Elena wanted an audit regime that would keep the system improving. Cost and effort mattered too: each route required preparation time, audit fees or staff time, and a commitment to ongoing audits.

# A simple decision matrix for external recognition routes.
# Scores 1-5 against Harrowgate's criteria; weights reflect priorities.
criteria = {"customer value": 0.30, "assurance": 0.25,
            "improvement pressure": 0.25, "cost and effort (5 = low)": 0.20}
routes = {
    "ISO 45001 certification": [5, 5, 4, 2],
    "Government recognition":  [3, 4, 4, 4],
    "Customer audits only":    [3, 2, 2, 5],
}
for route, scores in routes.items():
    total = sum(w * s for w, s in zip(criteria.values(), scores))
    print(f"{route}: {total:.2f}")

ISO 45001 certification: 4.15
Government recognition: 3.70
Customer audits only: 2.90

The matrix favoured certification, with WCB Safety Certified close behind. The leadership team chose both, in sequence: Safety Certified first, through Safety Services Nova Scotia, because its element-based audit mapped closely to what the company had built and its interview approach would test the system on the floor; then ISO 45001 certification to CSA Z45001 across all three sites, timed so that the internal audit program would have covered every clause at least once. The company's food safety certification body could also offer ISO 45001, which allowed some combined audit days.

Keeping recognition meaningful

External recognition can go wrong. Some organizations prepare intensively for an audit, pass, and let the system slide until the next one. Some coach workers on answers to likely interview questions. Some limit the certification scope to the safest parts of the business. Elena set three rules. No coaching: workers would be told an audit was happening and what it was for, but not what to say. Full scope: every site and every shift would be in scope, including nights and the distribution centre. And no audit-only actions: anything done to prepare for an audit had to be something the system needed anyway.

Getting ready: the readiness review

Six months before the first external audit, Elena and Aisha ran a readiness review. It was not an audit; it was a structured look at whether the system could stand up to one. They asked five questions of every element. Is there a documented requirement? Is there evidence it is done, on every site and shift? Do workers and supervisors know about it and can they describe it? Has it been audited internally, and were the findings closed and verified? And has it changed anything, such as a hazard removed, a near miss caught early or a decision made at management review?

The review found that most elements were in good shape on day shift at the main plant, weaker on nights and weakest at the sauces plant in Kentville, where the management system had arrived later and the site had only one supervisor per shift. Rather than paper over the gap, the leadership team gave the sauces plant extra support: a temporary safety coordinator for four months, worker auditors from the main plant, and a simplified set of procedures written with the site's own workers. Three months later, a second readiness check showed the sauces plant had caught up on the elements that mattered most.

What the first audit found

The Safety Certified audit took four days across the three sites. The auditors interviewed fifty-two workers, supervisors and managers, about a tenth of the workforce, chosen across shifts, departments and length of service, including agency workers at the distribution centre. Harrowgate passed, with its highest scores in hazard assessment, inspections and committee functions, and its lowest in training records and contractor management, where the roofing near miss had already exposed weaknesses. The audit report became a management review input, and its lowest-scoring elements became objectives for the following year.

Sam Pellerin, the worker co-chair at the distribution centre, was among those interviewed. Afterwards he told the committee that the auditor had asked him the same question Tanya Morris had asked at the start of the project, in different words: did the system change what happened on nights? This time he could give examples.

After recognition

Recognition is a point in time. The day after the audit, the hazards are the same, the night shift still runs short when people call in sick, and the next surveillance or maintenance audit is already on the calendar. Harrowgate Foods Ltd. treated the audit results the way it treated any other evidence: as inputs to improvement. It also kept recognition in proportion. The plaque went up in the main lobby, but the communication to workers focused on the three weakest findings and what would be done about them, and on thanking the people whose work the auditors had seen on the floor. Rachel Okoye told the leadership team that if the certificate ever became the reason the system existed, the system would have failed.