Most safety problems develop gradually through outdated procedures, incomplete records, inconsistent practices and corrective actions that quietly fall behind. The organization may appear to be operating normally until an incident, inspection or audit exposes those gaps all at once.
A workplace safety audit gives you an opportunity to find those weaknesses earlier.
Done properly, an audit is more than a document review or inspection checklist. It tests whether your health and safety system works as intended. It compares written requirements with real working conditions, identifies areas of risk and gives leadership a practical basis for deciding what to fix first.
This safety audit guide explains what audits and gap assessments cover, when to conduct one, how the process works and what to do with the findings. It is designed for HSE managers, operations leaders, HR teams, project managers, supervisors and procurement professionals who need a clearer view of workplace safety performance.
Table of Contents
1. Understanding Safety Audits and Gap Assessments
A workplace safety audit is a structured evaluation of an organization’s health and safety system, practices and working conditions.
A workplace safety audit is a structured review of your health and safety system, documentation and field practices. It can examine policies, training records, inspections, incident management, contractor oversight, legal requirements and how work is performed.
The goal is not simply to find missing paperwork. It is to determine whether your safety system works in practice, where risks or inconsistencies exist and what needs attention.
A gap assessment is similar, but more focused. It compares your current program with a specific requirement or future goal, such as preparing for COR or ISO 45001 certification, responding to a regulatory order or introducing a common safety standard across several locations.
In simple terms, an audit asks, “How well is our system working?” A gap assessment asks, “What is missing between where we are now and where we need to be?”
Common reviews include compliance audits, management system audits, certification gap assessments, field-level audits, contractor audits and targeted assessments focused on a specific issue. The right approach depends on the risk, requirement and business decision you need to address.
Learn more about understanding safety audits and gap assessments.
2. What Type of Safety Audit or Assessment Do You Need?
The right type of review depends on the question your organization needs answered. Some audits focus on legal compliance, while others examine the overall management system, field practices, contractors or readiness for certification.
Compliance audits
A compliance audit compares current practices with applicable legislation, regulations, contractual requirements or internal standards. It can help an organization prepare for an inspection, respond to regulatory concerns or confirm that required programs and records are in place.
Management system audits
A management system audit examines whether the organization’s health and safety processes work together effectively. It may review leadership, responsibilities, planning, communication, training, performance measurement and corrective action across one site or several locations.
Certification gap assessments
A certification gap assessment compares the current health and safety system with the requirements of a program or standard, such as COR or ISO 45001. It identifies what is already in place and what must be improved before a formal certification audit.
Field-level audits
A field-level audit looks at how work is performed. It compares written procedures and required controls with workplace conditions, worker practices, supervision and changing hazards.
Contractor audits
A contractor audit reviews whether contractors meet the organization’s health and safety expectations. It may examine prequalification, orientation, training, supervision, incident reporting, high-risk work and corrective-action follow-up.
Targeted assessments
A targeted assessment focuses on one defined program, hazard or concern, such as machine guarding, confined spaces, contractor management, incident investigation or training. It is useful when the organization needs a closer look at a specific area without reviewing the entire safety system.
These approaches often overlap. A management system audit may include compliance testing and field observations, while a contractor audit may examine both legal requirements and day-to-day practices. Defining the purpose before the review begins helps establish the right scope, criteria and evidence.
Learn more about what a health and safety management system audit examines and when your organization may need one.
3. Why Safety Gaps Develop
Most safety gaps are not ignored on purpose. They develop because people are focused on running the operation, responding to immediate issues and meeting production or project demands. When time and resources are limited, visible problems get attention first while system-level weaknesses remain in the background.
The work changes, but the program does not
A procedure may have been accurate when it was written, but equipment, materials, staffing, contractors or work methods can change over time. The document remains in place even though it no longer reflects how the task is performed.
Sites and teams apply standards differently
Corporate policies often allow for local interpretation. One site may complete inspections and close actions consistently, while another uses the same process with less follow-through. This creates gaps between the corporate program and day-to-day practice.
Familiar work creates blind spots
Tasks that have been completed many times without an incident can begin to feel safer than they are. Workers and supervisors may accept shortcuts or bypass controls because nothing has gone wrong yet.
Corrective actions lose momentum
Organizations often identify deficiencies but struggle to close them. Actions may be delayed by unclear ownership, limited resources or competing priorities. Over time, unresolved findings can become normalized.
Internal reviews can miss familiar problems
Internal audits are valuable, but familiarity can make gaps harder to see. Reviewers may focus on how the system is intended to work rather than how it works in practice. Workers may also be less candid with someone inside the organization.
Pressure tests the system
Safety controls are easiest to follow under normal conditions. Their true strength becomes clear when schedules slip, staffing changes, equipment is unavailable or work conditions shift. A strong audit looks at whether the system still works when the operation is under pressure.
Learn more about health and safety gap assessments.
4. A Practical Safety Audit Framework
An effective audit should answer four questions:
- What should be happening?
- What is happening now?
- Where is the gap?
- What should happen next?
This keeps the review focused on risk and action, not just paperwork.
Step 1: Establish the requirements
Define the criteria before the audit begins. These may include:
- Applicable legislation and regulations
- Corporate policies
- Client or contractual requirements
- COR or ISO 45001 criteria
- Contractor standards
- Previous audit commitments
Requirements differ by jurisdiction, sector and workplace, so the audit should reflect the actual obligations that apply rather than rely on a generic checklist.
Step 2: Gather evidence
Auditors usually review three types of evidence:
- Documents, such as procedures, training records, inspections, incident reports and corrective action logs
- Interviews with leaders, supervisors, workers, contractors and support teams
- Observations of work practices, equipment, safeguards, PPE, housekeeping and changing conditions
No single source tells the whole story. Strong findings are supported by more than one type of evidence.
Step 3: Test whether controls work in practice
Written intent is not the same as working reality.
A procedure may require daily inspections, but the audit should confirm that inspections happen, hazards are recorded and corrective actions are completed.
For example, forklift certificates alone do not prove an effective control. The auditor may also review operator authorization, practical evaluations, pre-use inspections, defect reporting, supervision and pedestrian controls.
Step 4: Assess the significance of each gap
Not every finding carries the same risk.
Auditors should consider:
- Potential severity
- Likelihood and frequency of exposure
- Number of people affected
- Legal or contractual significance
- Whether the issue is isolated or systemic
- Whether previous corrective actions have failed
This helps leadership prioritize serious risks instead of treating every finding as equal.
5. Preparing for and Conducting the Audit
Preparation should help the auditor understand the workplace; not make it look temporarily perfect. Organize the available information, identify key contacts and be open about known concerns.
Define the purpose and scope
Start with a clear objective, such as preparing for certification, reviewing controls after an incident, assessing contractor safety or comparing performance across locations.
Define which sites, departments, shifts, contractors and activities are included. In a large organization, the sample should represent higher-risk work, different shifts and a range of site conditions. The scope should also state what is excluded.
Assemble key records
Provide relevant documents in advance, including:
- Policies and procedures
- Hazard assessments
- Training and inspection records
- Incident investigations
- Emergency plans
- Maintenance records
- Previous audit reports
- Corrective action logs
- Contractor files
This allows more site time for interviews and observation.
Prepare employees for honest input
Employees should understand the purpose of the audit and know they may be interviewed, but they should not be coached.
Encourage them to speak openly about unclear procedures, difficult controls, unresolved concerns and what happens when work conditions change. These answers help identify real communication and training gaps.
Look beyond written procedures
Auditors should watch for workarounds, such as removed guards, delayed inspections or unused equipment. These practices may point to problems with design, planning, staffing, supervision or production expectations.
The key question is not only what happened, but why the workaround became necessary or accepted.
Compare different perspectives
Ask leaders, supervisors and workers similar questions. Differences in their answers can reveal gaps in communication, accountability and implementation.
The review should focus on causes, controls and responsibilities rather than blame. This protects the integrity of the audit while still allowing individual accountability where appropriate.
Learn more about compliance audits and how they work.
6.Turning Findings into Corrective Action
An audit report should help the organization decide what needs immediate attention, what points to a larger system weakness and what can be addressed through longer-term planning.
Prioritize the Findings
Not every finding carries the same level of risk. An uncontrolled fall hazard requires immediate action, while repeated missing inspection records may point to a broader issue with supervision, accountability or recordkeeping.
Use a consistent rating system based on factors such as:
- Severity and likelihood
- Legal or operational significance
- Number of people affected
- Whether the issue is isolated or systemic
- Whether previous corrective actions have failed
Address the Root Cause
Correcting the visible issue without understanding why it happened often leads to repeat findings.
For example, completing several missing worker orientations solves the immediate problem. A stronger response also examines who owns the process, how new workers are identified and who confirms orientation before work begins.
Look for patterns across findings. Several gaps may share a common cause, such as unclear ownership, weak communication, limited resources or inconsistent supervision.
Build a Clear Corrective Action Plan
Each action should identify:
- What needs to be corrected
- Who is accountable
- The priority and deadline
- Any necessary interim controls
- The evidence required for close-out
- Who will verify completion
Actions should be specific. “Review the procedure” is unclear. A better action names the responsible person, the required change, how it will be communicated and when it must be completed.
Verify That the Correction Works
An action should not be closed simply because a task was completed.
Installing a safeguard completes the work. Confirming that it functions properly, remains in place and does not create another hazard verifies effectiveness.
The goal is not just to close findings. It is to reduce the risk that causes them.
Learn how to build a corrective action plan after a safety audit.
7. Applying Safety Audits to Construction Work
Construction sites change constantly. Crews, contractors, equipment, access routes and work activities can shift from one day to the next. A safety program that looked complete during project planning may no longer reflect what is happening in the field.
Maintaining safety compliance in construction therefore requires more than checking whether policies and forms exist. An audit should test whether responsibilities are understood, hazards are reassessed as work changes and required controls are being used consistently.
Focus on the work happening now
Compare written procedures with current site conditions. Review whether:
- Hazard assessments reflect the task and location
- Workers and supervisors understand their responsibilities
- Training matches the equipment and work assigned
- Inspections identify meaningful issues
- High-risk work follows the required controls
- Changes in scope or sequencing trigger a new review
Construction supervisors play an important role in directing work, communicating hazards and ensuring workers follow required procedures and use protective equipment.
Review how contractors work together
Construction projects often involve several employers and subcontractors. The audit should examine not only each contractor’s program, but how responsibilities are coordinated across the site.
Look at orientation, communication, supervision, incident reporting, high-risk work and the process for correcting deficiencies. In Ontario, the constructor generally has overall authority for health and safety on the project, while employers, supervisors and workers also have defined duties. Requirements vary by jurisdiction.
Follow findings through to completion
Prioritize immediate hazards, assign one accountable owner to each action and set deadlines based on risk. When a permanent fix takes time, document and monitor suitable interim controls.
Finally, verify that the correction works in the field. The goal is not simply to close an audit finding. It is to confirm that the risk has been reduced while the project continues to change.
For a closer look at how safety audits apply to active construction sites, read our related article on applying safety audits to construction work.
Quick FAQ
What is the difference between a safety audit and a workplace inspection?
An inspection usually focuses on current physical conditions, behaviours and hazards in a specific work area. A safety audit takes a broader view. It examines whether the organization’s policies, responsibilities, training, records, controls and follow-up processes work together as an effective safety system.
How often should a workplace safety audit be completed?
The right frequency depends on your jurisdiction, industry, certification requirements, risk level and rate of change. Audits may be scheduled annually, as part of a certification cycle or after major changes, incidents or recurring deficiencies. Higher risk and multi-site organizations may need more frequent targeted reviews.
How long does a safety audit take?
Timing depends on the number of sites, employees, shifts, processes and standards being reviewed. A targeted assessment may be relatively short. A multi-site management system audit can require extensive document review, interviews, field observation and reporting. A clear scope helps establish a realistic schedule.
Can we conduct a safety audit with our internal team?
Yes. Internal audits are an important part of safety management and continuous improvement. Your team needs suitable training, time, authority and independence from the activity being reviewed. An external audit can add objectivity or specialized expertise when internal capacity is limited or independent verification is required.
What should happen after a safety audit?
Leadership should review the findings, control urgent hazards and approve a prioritized corrective action plan. Each action needs an owner, timeline and close-out evidence. The organization should then verify that completed actions work in practice and share relevant lessons across other departments or sites.
Next Steps
A strong audit should tell you more than what is wrong. It should show you which gaps create the greatest exposure, why they exist and what your team should do next.
Use this safety audit guide to review your current process, clarify your audit scope and identify areas where an independent assessment could provide better insight.
You can find out more about our safety audit and gap assessment services to see how objective reviews, field observations and corrective action planning can support your organization.
When you are ready to discuss your sites, standards, audit history or current compliance concerns, contact us to talk with an expert.