Short answer. A health and safety audit checks whether your safety management system actually works in practice, not just on paper, against a recognised framework such as HSG65's Plan, Do, Check, Act model, ISO 45001, or an SSIP scheme like CHAS or SafeContractor. Preparation is straightforward: get your documentation in order, walk the site with fresh eyes, brief your team, and be honest about the gaps.
The words "health and safety audit" tend to produce one of two reactions: mild panic or total indifference. Neither is ideal. The panic leads to a frantic scramble to get everything in order at the last minute. The indifference leads to an uncomfortable meeting when the auditor starts asking questions nobody can answer.
Surviving a health and safety audit is entirely achievable, and with the right preparation it can actually be useful.
What a health and safety audit actually is
HSE's own guidance, HSG65, sets out health and safety management around a Plan, Do, Check, Act cycle: you plan your approach, put it into practice, check that it is working, and act on what you find. An audit sits in the "check" stage. It is a systematic, evidence-based review of whether the management system as a whole is functioning, rather than a snapshot of physical hazards on a particular day.
Audits arrive for different reasons. Some organisations are audited against ISO 45001, the international occupational health and safety management standard. Many more UK businesses meet their first proper audit through an SSIP scheme, CHAS, SafeContractor or Constructionline among them, because a client or principal contractor requires supply chain accreditation before awarding work. Insurers and internal review teams run their own versions too. The scope and paperwork vary, but the underlying question is the same: does your safety management system work, or does it just exist on paper?
Audit versus inspection
The two get used interchangeably, but they are not the same thing. An inspection is a physical check of the workplace at a point in time: are fire exits clear, are guards in place, is housekeeping acceptable. An audit is broader. It looks at the management system behind those conditions, the policy, the risk assessments, the training records, the way incidents get investigated, and asks whether the system that is supposed to produce a safe workplace is actually doing so. A site walk is usually part of an audit, but it is one piece of evidence among several, not the whole exercise.
What auditors ask for
Most audits examine the same core evidence: a current, signed health and safety policy, risk assessments that reflect actual activities, training records showing who has been trained on what and when, incident records showing that events are reported, investigated and actioned, maintenance and inspection records for safety-critical equipment, evidence that senior management actively reviews safety performance, and evidence that employees are consulted on health and safety.
The common thread is evidence. Auditors do not just want to hear that you do these things; they want to see documented proof.
How to prepare
Start reviewing your documentation against the audit scope well before the date. Check that policies are dated and signed by current senior management, that training records are complete and up to date, that incident records show investigation and follow-up action, and that any previous audit findings have been addressed. Risk assessments should reflect what actually happens on site now; the legal test for review is not a fixed calendar interval but whether the assessment is still valid or whether something significant has changed, though reviewing annually as a matter of routine is sensible practice for most sites.
Walk the workplace with fresh eyes. Are fire exits clear, are extinguishers serviced and accessible, are safety signs in place, is housekeeping acceptable, are machine guards in place and functioning, are first aid kits stocked? The auditor will do a site walk of their own, so make sure what they see matches what your documents say.
Brief your team. Auditors often speak to employees and supervisors directly. Staff should know where to find emergency procedures, who their first aider and fire warden are, how to report an incident, and what risk assessments apply to their own work. They do not need to recite legislation; they need to show practical awareness.
During the audit
Be honest. If you do not have something, say so. An honest admission of a gap, with a plan to address it, lands far better than an attempt to bluff, which is almost always spotted and damages credibility for the rest of the audit. Be organised, with documents ready to hand rather than searched for on the day, and be proactive: raising a known issue yourself, with a plan attached, reads much better than having the auditor find it first.
After the audit
The report will typically distinguish findings, observations and recommendations. Findings need fixing, whether that is a non-conformance against the standard or a legal compliance gap. Observations are areas for improvement that are not necessarily failures. Recommendations are suggestions for enhancement. Build an action plan with clear ownership and deadlines, address findings first, and track progress: the next audit will check what has been done since the last one, and no movement on a previous finding is one of the worst things an auditor can write.
Turning audits into an advantage
An experienced auditor will spot things you have missed and point to practices they have seen work well elsewhere. Used properly, an audit is a structured health check for your safety management system rather than an obstacle to get through. The businesses that come out of audits well are not the ones with flawless systems; they are the ones that take the process seriously, address issues promptly, and treat the findings as something to act on rather than file away.
York Green's safety management systems service covers exactly this ground: building a system that holds up under audit because it reflects how the site actually operates. For the underlying framework, see HSE's guidance on managing for health and safety (HSG65).