What Is Auditing? A Practical Guide for Safety Teams

Auditing, in one line

Auditing is checking that what you wrote down is what you actually do.

That is it. You have procedures, work instructions, permits, a management system. Auditing is the recurring, evidenced check that the reality on the floor still matches those documents, and that the documents still match reality. Both directions. Most people only think about the first one.

A single audit is an event. Auditing is the discipline: a cycle that repeats, produces evidence, and feeds corrective actions back into the system. If you want the anatomy of one audit, we covered that separately in what is an audit. This piece is about the practice.

Auditing is not inspection, and not assessment

These three words get used interchangeably in day-to-day conversation, and then people talk past each other in the closing meeting. Short definitions:

• Inspection looks at a thing. A ladder, a valve, an eyewash station, a work permit in progress. Is this item, right now, in the state it should be in?
• Auditing looks at a system. Not "is this eyewash station in date" but "does the process that keeps eyewash stations in date actually work, and can you show me".
• Assessment scores you against a target. A gap analysis against a standard, a vetting questionnaire, a maturity model. It tells you distance, not conformity.

The distinction matters because a finding at inspection level and a finding at system level need completely different corrective actions. An expired eyewash station is a five minute fix. An expired eyewash station that nobody noticed for weeks is a system finding, and replacing the bottle does not close it.

The four parts of any audit cycle

Whatever the standard, the mechanics are the same:

1. Scope and criteria. What are you auditing against? A clause, a procedure, an element of your management system. Vague criteria produce vague findings, and vague findings do not survive a discussion.
2. Evidence. Records, observations, interviews. Evidence is what separates an audit from an opinion.
3. Findings. Conformity, nonconformity, observation. Each one anchored to a criterion and a piece of evidence.
4. Corrective action. Owner, deadline, verification. A finding without a closed action is a finding you will see again next cycle.

Everything else, the audit plan, the opening meeting, the report format, is scaffolding around those four.

Where auditing actually falls over

Not in the theory. In the execution, and always in the same three places.

The checklist is longer than the time you gave it. A four page checklist and two hours to walk a large installation. That does not work, and everyone knows it does not work. What happens instead is that the list gets printed, walked at speed, and ticked on paper afterwards. You have not audited anything. You have produced a document that says you did.

The route is designed by the document, not by the plant. If your checklist mixes topics in whatever order the standard lists them, the auditor walks the same installation four times, or does not walk it at all. Order the questions the way a person physically moves through the site.

The knowledge leaves. The engineer who explained a construction verbally to an inspector three years ago has retired. Nobody wrote down what was agreed or why. Then the same topic comes back, this time as a written finding, and there is nothing in the file to have the discussion with. This is the quiet one, and it is the expensive one.

There is a fourth, less comfortable, one. Not every written finding is correct. When a regulator, DCMR or the Nederlandse Arbeidsinspectie, writes something up, it is worth checking what the actual legal basis is. Our experience is that the basis is not always there, and that the conversation goes better when it is about facts rather than interpretation. That only works if your own file is in order. Which brings you back to evidence.

What to actually do

Concrete, in the order we would do it:

• Cut the checklist. Fewer questions, better questions. A question you can answer honestly in the field beats a question that gets ticked in the car park.
• Sort by walking route, not by clause number. Map the clause afterwards.
• Capture evidence at the moment of observation. A photo, a location, a timestamp, taken there. Not reconstructed that evening.
• Write findings against a named criterion. "Insufficiently demonstrable that X" is a finding you can discuss. "It is not good" is not.
• Give every action an owner and a verification step, and treat "verified" as a separate state from "done".
• Feed changes back. If an audit turns up a change to the installation or the procedure that was never processed upstream, that is a management of change item, not an audit note.
• Audit the audit. Once a year, look at your own findings. If ninety percent of them are housekeeping, your criteria are too shallow.

Auditing beyond safety

The same mechanics run outside EHS. Supplier audits, ESG reporting, sector vetting regimes. If you report on sustainability, the ESG score you publish is only as defensible as the evidence trail behind it. In shipping, TMSA vetting is essentially an externally imposed audit cycle with a scoring layer on top. Different vocabulary, same four parts.

Where software helps, and where it does not

Software is good at the boring, structural part: the same form every time, evidence attached at the point of observation, actions with owners and dates that do not disappear into a mailbox, a searchable history so the knowledge does not leave with the person.

It does not make you compliant. It does not decide whether a finding is real, and it does not take ownership of your management system, your veiligheidsbeheerssysteem stays yours. If your criteria are wrong, digitising them just gives you wrong findings faster. And for high threshold sites the generic tooling tends to stop exactly where it gets interesting, which we wrote about in why generic safety management software falls short for Seveso III companies.

A short, honest next step

Take your most recent audit report. Look at the findings and ask two things: could I defend each one on the facts, and is each corrective action actually verified. If the answer to either is no, that is your starting point, and you do not need to buy anything to begin.

If you want to see how the inspection and corrective action side works in practice, we are happy to walk you through it. No polish, just the system as it stands.