Safety audits: internal, management system and certification audits

Inspections look at conditions and practices at a moment in time. They can show that a guard is missing today. They cannot easily show why guards keep going missing, whether the lockout program as a whole is designed and run properly, or whether the safety management system built in HSE-404 is doing what it claims. That is the job of audits. This lesson describes the kinds of audit Harrowgate Foods Inc. uses, the principles that make an audit trustworthy, and how the company built an audit program that put its effort where the risk was highest.

What an audit is

ISO 19011, the international guideline for auditing management systems, defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Each word matters. Systematic means the audit follows a plan. Independent means the auditor does not audit his or her own work. Documented means the plan, the evidence and the conclusions are written down. Objective evidence means records, observations and statements that can be verified. And audit criteria are the requirements the audit compares the evidence against, such as a law, a standard, a company procedure or a contract.

The difference from an inspection is mainly scope and depth. An inspection of the bread line asks whether its guards and lockout points are in good order today. An audit of the lockout program asks whether every machine has a correct procedure, whether workers are trained and competent, whether locks are applied and verified as the procedures require, whether periodic reviews happen, whether problems found are corrected, and whether all of this is working across the site and over time.

Three kinds of audit criteria

Audits at Harrowgate Foods Inc. use three kinds of criteria, and many audits combine them:

• Compliance audits compare practice with legal requirements, such as the federal Occupational Safety and Health Act (OSH Act) and OSHA's general industry standards in 29 CFR 1910. They answer the question: are we meeting the law?
• Management system audits compare the system with a standard such as ISO 45001 or ANSI/ASSP Z10.0, and with the company's own procedures. They answer: is the system designed properly and working?
• Topic or process audits look in depth at one program, such as lockout, contractor control or ammonia, against all the requirements that apply to it, whether legal, standard-based or internal. They answer: is this program effective? OSHA's lockout standard, for example, requires a periodic inspection of each energy control procedure at least once a year by an authorized employee other than those using it, which is itself a small, required audit.

First, second and third parties

Audits are also classed by who does them:

• First-party audits are internal audits done by or for the organization itself. ISO 45001 requires them at planned intervals, as part of the check step of the system.
• Second-party audits are done by an organization with an interest in the auditee, such as a customer auditing a supplier. Several of Harrowgate Foods Inc.'s retail customers audit its plants for food safety, and two now include worker safety questions.
• Third-party audits are done by independent bodies, such as certification bodies auditing against ISO 45001 or a regulator's or insurer's audit program. They give assurance that others can rely on.

Third-party certification to ISO 45001 follows a cycle. An accredited certification body carries out an initial audit in two stages, the first reviewing the system's design and readiness and the second assessing whether it is implemented and effective. If the body is satisfied, it issues a certificate valid for three years, with surveillance audits at least once a year and a recertification audit before the certificate expires. Certification does not mean that a company is safe. It means that an independent auditor found a management system that met the standard, based on a sample of evidence on the days of the audit.

The principles of auditing

ISO 19011 sets out seven principles that make an audit worth trusting. Elena printed them on the cover of the new audit procedure:

• Integrity: auditors work honestly, diligently and responsibly, and are not influenced by pressure to reach a particular result.
• Fair presentation: findings, conclusions and reports reflect the audit truthfully and accurately, including obstacles met and unresolved disagreements.
• Due professional care: auditors apply diligence and judgment appropriate to the importance of the task.
• Confidentiality: information obtained during the audit is protected and used appropriately.
• Independence: auditors are free from bias and conflicts of interest, and do not audit their own work.
• Evidence-based approach: conclusions rest on verifiable evidence, recognizing that audits rely on samples.
• Risk-based approach: audit effort is directed at matters that are significant to the client and the audit's objectives.

Independence was the hardest principle for a company of Harrowgate Foods Inc.'s size. It did not have a full-time internal audit team, and Elena could not audit the programs she had designed. The working group's answer was cross-site auditing. Trained auditors from one site audited another: supervisors and safety committee members from Athens audited McDonough, McDonough audited Gainesville, and Gainesville audited Athens. Elena led the audit program and trained the auditors, and Aisha Rahman's quality team, which already ran food safety internal audits, provided auditors with no stake in safety outcomes.

Building the audit program

An audit program is the set of audits planned for a period, usually a year or three years, with their scope, criteria, frequency and resources. ISO 45001 requires the program to take into account the importance of the processes concerned and the results of previous audits. Elena turned that into a simple scoring rule: a topic's audit frequency depended on the severity of its hazards, the result of its last audit and how much it had changed in the last year.

# Set audit frequency for each topic and site from a simple risk score
topics = [
    # (topic, site, severity 1-5, last audit result %, changes in last year 0-3)
    ("lockout",             "main plant",   5, 68, 2),
    ("lockout",             "sauces plant", 5, 88, 0),
    ("forklift traffic",    "distribution", 5, 61, 3),
    ("forklift traffic",    "main plant",   4, 82, 1),
    ("ammonia system",      "main plant",   5, 90, 1),
    ("ammonia system",      "distribution", 5, 79, 0),
    ("machine guarding",    "main plant",   4, 74, 2),
    ("contractor control",  "main plant",   4, 84, 1),
    ("chemical handling",   "sauces plant", 3, 93, 0),
    ("first aid and ERP",   "distribution", 2, 95, 0),
]
def score(sev, result, changes):
    weakness = (100 - result) / 10        # 0 for a perfect audit, 4 for 60 %
    return sev * (1 + weakness) + 2 * changes
def frequency(s, sev):
    months = 6 if s >= 25 else 12 if s >= 15 else 24   # months between audits
    if sev == 5:
        months = min(months, 12)   # floor: catastrophic hazards at least yearly
    return months
print(f"{'topic':<20}{'site':<14}{'score':>6}{'every':>7}")
for t, site, sev, res, ch in sorted(topics, key=lambda x: -score(*x[2:])):
    s = score(sev, res, ch)
    print(f"{t:<20}{site:<14}{s:>6.1f}{frequency(s, sev):>4} mo")

topic               site           score  every
forklift traffic    distribution    30.5   6 mo
lockout             main plant      25.0   6 mo
machine guarding    main plant      18.4  12 mo
ammonia system      distribution    15.5  12 mo
forklift traffic    main plant      13.2  24 mo
contractor control  main plant      12.4  24 mo
ammonia system      main plant      12.0  12 mo
lockout             sauces plant    11.0  12 mo
chemical handling   sauces plant     5.1  24 mo
first aid and ERP   distribution     3.0  24 mo

The first version of the rule had no floor, and it scheduled the ammonia system at Gainesville for an audit only every two years because its last audit had gone well. Luis objected: a single failure in that system could kill people inside and outside the plant. The group added a floor so that any topic with catastrophic potential would be audited at least once a year, whatever its score. Elena noted that this was exactly the kind of judgment a formula should support, not replace.

Integrating safety and food safety audits

Harrowgate Foods Inc.'s plants were already audited each year against a food safety certification scheme, and Aisha's team ran internal food safety audits every quarter. Running separate safety audits on different days, with different auditors asking the same supervisors about training records, document control and corrective actions, would waste time and annoy everyone.

The working group combined the parts that overlapped. Document control, training records, management of change, corrective action and management review were audited once, with questions covering both food safety and worker safety. Sanitation audits checked both that equipment was clean and that it had been locked out for cleaning. Topic audits on hazards specific to safety, such as forklift traffic or ammonia, stayed separate. Aisha pointed out a benefit nobody had expected: the food safety auditors, trained to look for evidence rather than reassurance, were among the best safety auditors the company had.

Preparing auditors

Good auditors are made, not found. The company's auditor course ran over two days and covered the principles above, how to plan an audit, how to sample, how to interview without leading, how to tell an observation from an opinion, and how to write a finding. Each new auditor then did two audits as an observer and one under supervision before leading an audit. Dev Sandhu, the night sanitation supervisor at Gainesville, was one of the first to qualify, and his knowledge of night work made him one of the best interviewers in the program.

Outside reviews that are not audits

Some outside reviews look like audits but are not. A visit by an OSHA compliance safety and health officer is an inspection under the law, not an audit the company commissions, and it can lead to citations. The company's workers' compensation insurer may also send loss control consultants who make recommendations, and OSHA's free On-Site Consultation Program can review a site without issuing citations. These reviews give useful outside views, and the audit program treats their findings as inputs: every citation or recommendation is logged, assigned an owner and tracked in the same corrective action system as audit findings. But they do not replace the internal audits that ISO 45001 requires, because the company does not set their scope, timing or criteria.

Elena added one more source to the list: the audits of Harrowgate Foods Inc.'s own contractors described in HSE-406. Their results showed how well the contractor program was working, and the audit program treated them as part of the evidence for the contractor control topic.