External recognition: audits, VPP and SHARP

Eighteen months into the system, Rachel Okoye asked the question every leadership team eventually asks: should Harrowgate Foods Inc. have its system checked by someone outside the company? Customers had begun asking. Two large grocery chains now included a safety section in their supplier questionnaires, and one asked whether suppliers held an external safety certification. The board wanted assurance that the system was more than a set of binders. And Elena Novak believed that the discipline of an external audit would keep the system honest once the novelty had worn off.

This lesson covers the main forms of external recognition available to Harrowgate Foods Inc., what each involves, and how to decide whether to pursue them. The aim of external recognition is not the certificate on the wall. It is an independent check, a structured way to find gaps, and a commitment that is hard to quietly abandon.

Three kinds of external check

Organizations in Georgia have three main routes to external recognition of their safety management system. The first is certification to ISO 45001 by an accredited certification body. The second is recognition by OSHA through the Voluntary Protection Programs (VPP) or, for smaller employers, the Safety and Health Achievement Recognition Program (SHARP) run through the On-Site Consultation Program. The third is customer or industry audits, such as the second-party audits large customers carry out on their suppliers.

Certification to ISO 45001

Certification means that an independent certification body, accredited to audit management systems, confirms that the organization's system conforms to ISO 45001. In the United States, the ANSI National Accreditation Board (ANAB) accredits certification bodies; an accredited certificate carries more weight with customers than one from an unaccredited body.

A certification audit has a standard sequence. Many organizations start with an optional pre-assessment, an informal rehearsal that finds gaps before the real thing. The stage 1 audit reviews the system's documentation, the organization's context, its legal register, its readiness and the scope of certification, and plans stage 2. The stage 2 audit, usually a few weeks later, tests implementation and effectiveness on site: auditors interview workers and managers, observe work, sample records and trace processes. Major nonconformities must be corrected before the certificate is issued; minor ones need an accepted action plan.

Once certified, the organization faces surveillance audits, usually once a year, which sample parts of the system, and a recertification audit every three years that reviews the whole system again. Certification is a commitment to be audited year after year, which is much of its value.

What auditors look for

Experienced auditors look for evidence that the system is alive. They ask workers on the floor what the policy means to them, how they report a hazard, what happened the last time they did, and whether they would stop unsafe work. They check whether the hazard register reflects the hazards they can see, whether incidents led to corrective actions that were verified, whether the internal audits found real problems, and whether management review made decisions. A system that looks perfect on paper but whose workers have never heard of it fails quickly.

Recognition programs

OSHA's Voluntary Protection Programs recognize employers and workers in the private sector and federal agencies that have implemented effective safety and health management systems and maintain injury and illness rates below the national averages for their industries. An employer applies to OSHA, which reviews the application and conducts a rigorous onsite evaluation by a team that interviews workers and managers, inspects the site and reviews records. Approved sites are removed from OSHA's programmed inspection lists while they participate, though OSHA still responds to complaints, fatalities and serious incidents. Sites are reevaluated periodically and submit annual self-evaluations.

VPP changed in 2026. OSHA's updated VPP Policies and Procedures Manual took effect on June 16, 2026. It aligns VPP with the seven core elements of OSHA's Recommended Practices for Safety and Health Programs: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, program evaluation and improvement, and communication and coordination for host employers, contractors and staffing agencies. The updated program also introduced new recognition levels, including VPP Elite and VPP Emeritus, to recognize sites with sustained performance and those that help others improve.

For small employers, the route is different. OSHA's On-Site Consultation Program offers free, confidential safety and health consultation to small and medium-sized businesses, separate from enforcement. In Georgia, the program is delivered through Georgia Tech. An employer that receives a full-service consultation visit, corrects all identified hazards, implements an effective safety and health program and meets the rate criteria can apply for SHARP. SHARP sites are exempt from programmed OSHA inspections for a set period and can renew. SHARP is often a stepping stone toward VPP.

At Harrowgate Foods Inc., the routes matched the sites. The Gainesville main plant, with about 420 workers, was a candidate for VPP. The Athens sauces plant, with about 60 workers, was well suited to On-Site Consultation and SHARP, and its manager had already requested a consultation visit after the roofing near miss in lesson 9.

Second-party customer audits

Customer audits sit alongside formal recognition. Large customers increasingly audit suppliers' safety as well as quality, because a serious incident at a supplier can disrupt supply and damage the customer's reputation. Aisha Rahman's food safety team already hosted several customer audits a year, and the two grocery chains asked to add a safety module. Rather than prepare separately for each, Harrowgate Foods Inc. mapped the customers' questions to its own system and kept a single evidence pack, updated after each management review.

Comparing the routes

Deciding what to pursue

Harrowgate Foods Inc. weighed the options against what it wanted from external recognition. Customers wanted evidence. The board wanted independent assurance. Elena wanted an audit regime that would keep the system improving. Cost and effort mattered too: each route required preparation time, audit fees or staff time, and a commitment to ongoing audits.

# A simple decision matrix for external recognition routes.
# Scores 1-5 against Harrowgate's criteria; weights reflect priorities.
criteria = {"customer value": 0.30, "assurance": 0.25,
            "improvement pressure": 0.25, "cost and effort (5 = low)": 0.20}
routes = {
    "ISO 45001 certification": [5, 5, 4, 2],
    "Government recognition":  [3, 4, 4, 4],
    "Customer audits only":    [3, 2, 2, 5],
}
for route, scores in routes.items():
    total = sum(w * s for w, s in zip(criteria.values(), scores))
    print(f"{route}: {total:.2f}")

ISO 45001 certification: 4.15
Government recognition: 3.70
Customer audits only: 2.90

The matrix favored certification, with government recognition close behind. The leadership team chose a combined path: ISO 45001 certification across all three sites, timed so that the internal audit program would have covered every clause at least once; On-Site Consultation and a SHARP application at the Athens sauces plant; and a VPP application at Gainesville once it had three years of rate data below its industry average. The company's food safety certification body could also offer ISO 45001, which allowed some combined audit days.

Keeping recognition meaningful

External recognition can go wrong. Some organizations prepare intensively for an audit, pass, and let the system slide until the next one. Some coach workers on answers to likely interview questions. Some limit the certification scope to the safest parts of the business. Elena set three rules. No coaching: workers would be told an audit was happening and what it was for, but not what to say. Full scope: every site and every shift would be in scope, including nights and the distribution center. And no audit-only actions: anything done to prepare for an audit had to be something the system needed anyway.

Getting ready: the readiness review

Six months before the first external audit, Elena and Aisha ran a readiness review. It was not an audit; it was a structured look at whether the system could stand up to one. They asked five questions of every element. Is there a documented requirement? Is there evidence it is done, on every site and shift? Do workers and supervisors know about it and can they describe it? Has it been audited internally, and were the findings closed and verified? And has it changed anything, such as a hazard removed, a near miss caught early or a decision made at management review?

The review found that most elements were in good shape on day shift at the main plant, weaker on nights and weakest at the sauces plant in Athens, where the management system had arrived later and the site had only one supervisor per shift. Rather than paper over the gap, the leadership team gave the sauces plant extra support: a temporary safety coordinator for four months, worker auditors from the main plant, and a simplified set of procedures written with the site's own workers. Three months later, a second readiness check showed the sauces plant had caught up on the elements that mattered most.

What the first audit found

The ISO 45001 stage 2 audit took four days across the three sites. The auditors interviewed fifty-two workers, supervisors and managers, about a tenth of the workforce, chosen across shifts, departments and length of service, including staffing agency workers at the distribution center. Harrowgate Foods Inc. was recommended for certification with no major nonconformities and three minor ones, in training records, contractor management and night-shift participation, where the roofing near miss had already exposed weaknesses. The audit report became a management review input, and the minor nonconformities became objectives for the following year.

Sam Pellerin, the worker co-chair at the distribution center, was among those interviewed. Afterwards he told the committee that the auditor had asked him the same question Tanya Morris had asked at the start of the project, in different words: did the system change what happened on nights? This time he could give examples.

After recognition

Recognition is a point in time. The day after the audit, the hazards are the same, the night shift still runs short when people call in sick, and the next surveillance or maintenance audit is already on the calendar. Harrowgate Foods Inc. treated the audit results the way it treated any other evidence: as inputs to improvement. It also kept recognition in proportion. The plaque went up in the main lobby, but the communication to workers focused on the three weakest findings and what would be done about them, and on thanking the people whose work the auditors had seen on the floor. Rachel Okoye told the leadership team that if the certificate ever became the reason the system existed, the system would have failed.