Would You Pass Your Own Safety Audit?

You walked the site on Friday. Checked the extinguishers, cleared the walkway, had a look at the guarding, made a note about the dodgy extension lead.

Good. That's an inspection.

But it won't tell you whether your safety system works.

Most small businesses in Australia do some version of an inspection. Some do it formally with a checklist. Plenty just walk around with their eyes open, which is better than nothing. Very few of them audit. And because an inspection usually comes back clean, the assumption is that everything underneath it is fine too.

It often isn't.

An inspection and an audit are two different jobs

An inspection looks at the workplace. Is the guard on the saw, is the walkway clear, is the extinguisher in date, is the ladder the right one for the job. It's a snapshot. It answers one question: is this place safe right now?

An audit looks at the system behind the workplace. Do we have a written procedure for this task, is anyone actually following it, and could we prove it if someone asked. It answers a harder question: will this still be safe in three months, and could we show our working?

Put simply, an inspection finds the hazard. An audit finds the reason the hazard was there in the first place.

Say your inspection turns up a worker using a grinder without a face shield. The inspection result is "worker needs a face shield". Fair enough, and you fix it on the spot.

An audit asks the follow-up questions. Do we have a PPE procedure that covers this task? Was that worker inducted into it? Is there a record of that induction? Did anyone issue the face shield, and is it on the PPE register? When did we last check any of this? The answers usually explain why the shield wasn't on, and they tell you whether the same thing is about to happen with the next new starter.

Here's the part that catches people out. Step one of any audit is listing the procedures you're auditing against. Not the hazards. The procedures. If that list is short, borrowed from another business, or doesn't exist at all, you've found a problem before you've properly started.

The bit that's actually in the law

To be clear about this up front: there's no WHS law that says you must run an annual audit. Audits are a method, not a mandate. What the law does require is that you keep your controls working, and that you review them.

Under the WHS Regulations, a duty holder has to review and, where needed, revise control measures. Not once at the beginning. Specifically:

• when a control measure isn't effectively controlling the risk

• before a change at the workplace that's likely to give rise to a new or different risk

• when a new hazard or risk is identified

• when the results of consultation indicate a review is needed

• when a health and safety representative requests one

The model code of practice on managing WHS risks doesn't set a fixed calendar for this. It sets a priority: the higher the risk, the more often you should be reviewing.

If you're in Victoria, you're under the Occupational Health and Safety Act 2004, which doesn't carry a single review clause like the one above. Instead the duty to provide and maintain safe systems of work runs continuously, and individual regulations set their own review rules for particular hazards. Different structure, same practical outcome: your controls have to keep working, and someone has to check.

There's one more duty worth naming, because it's the one most often left out. Consulting your workers on health and safety matters is a legal duty in its own right, under sections 47 to 49 of the WHS Act and section 35 of the Victorian OHS Act. That includes when you're identifying hazards, deciding on controls, and reviewing them. An audit done alone at a desk isn't just less useful. It skips a duty.

What "proof" actually means

Three moments turn a quiet safety system into an urgent problem.

A regulator asks for evidence after an incident. A head contractor or tender assessor asks when you last reviewed your system. An insurer asks what you had in place at the time.

In all three, handing over the document isn't the win people expect it to be. Anyone can buy or download a procedure. What gets asked next is whether it was used.

That means signed induction records. Completed inspection forms with dates on them. Toolbox talk attendance sheets. A training register showing licences and their expiry dates. Incident reports that were actually filled in, not recalled from memory. Corrective actions with a name and a date against them.

A clean walkaround and a manual nobody has opened since the day it was bought are not the same thing as a working safety system. The first one looks fine. The second one holds up when someone tests it.

"We're too small for this"

This is the most common objection, and it usually comes with a version of "audits are a big company thing" or "that's what you pay a consultant for".

You can pay someone. Plenty of businesses do, and for higher-risk operations or a formal certification like ISO 45001, an external auditor makes sense. But nothing requires it, and for a business of three to fifteen workers, an internal audit you run yourself should find most of what's there.

The size argument also cuts the other way. A large business has redundancy. If one supervisor stops running toolbox talks, someone else notices. In a small business, the whole safety system usually runs on one person's memory, and that person is also quoting jobs, chasing invoices and doing the work. The system drifts quietly, and there's nobody positioned to see it. That's exactly the situation an audit is designed for.

How to run your own audit this week

1. List your procedures. Everything you're meant to be working to. Risk management, induction, training, PPE, plant and equipment, incident reporting, emergency procedures, consultation. If the list is thin, that's your first finding, and it's the important one.

2. Pick five and hunt for evidence. Not the whole system at once. Five. For each one, go looking for a piece of paper or a file that proves it happened. If you can't find it in ten minutes, treat it as missing.

3. Ask the workers doing the work. Ten minutes of honest questions will find more than an hour with a clipboard. What do you actually do when the guard is in the way? Who did your induction? Where's the SDS for that product? Their answers tell you whether the procedure describes real life or fiction.

4. Write down every gap. Including the ones where the work is being done properly but there's no record of it. No evidence is still a gap, because evidence is the thing you'll be asked for.

5. Give each gap an owner and a date. This is the corrective action, and it's what turns a list of problems into an audit. A gap without a name and a date next to it just gets found again next year.

Then diarise the next one. At least yearly, and any time the work, the site, the plant or the crew changes.

Where the documentation fits

An audit is only as good as the thing you're auditing against. If step one came up empty, no amount of walking around will fix it, because there's no standard to measure against.

That's what a WHS Management System gives you: the procedures, forms and registers that make an audit possible in the first place.

---

Get the documentation right first

If you came up hands empty at "list your procedures", that's your first step. Our WHS Management Systems give you specific procedures, forms and registers built by WHS specialists and aligned to Australian regulations. One-off price, no subscription, fully editable, yours to keep.

See our WHS Management Systems →

Everything OHS has been helping Australian small businesses get their WHS documentation sorted since 2008. More than 12,000 businesses have used our systems, and we've earned 60+ five-star Google reviews along the way. If you're not sure where your system stands, that's a good reason to run an audit rather than a reason to put one off.