A well-built internal audit schedule is the difference between an IMS that works and one that only looks good on paper. Many businesses audit once a year, in a rush, just before the certification body arrives. Problems found that late cost more to fix and are harder to explain.
Internal audits exist to give you the truth early. ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018 all require them under Clause 9.2. They also feed your management review, so weak audits quietly weaken every decision above them.
This post shows how to plan audits that verify your IMS and drive real corrections.
What Clause 9.2 and the WHS Act require
All three standards ask you to audit at planned intervals. The audit checks that your system meets your own requirements and the standard. It also checks that the system is implemented and maintained effectively.
To do this, you must plan, establish, implement and maintain an audit programme. The programme sets the frequency, methods, responsibilities, planning requirements and reporting. It must reflect the importance of each process and the results of previous audits. ISO 45001:2018 adds that worker consultation forms part of that programme.
Auditors must be objective and impartial. Results go to the relevant managers. Corrections follow without undue delay, and you keep documented information as evidence. ISO 19011:2018 gives practical guidance on all of this, including auditor competence.
The law points the same way. Section 19 of the Work Health and Safety Act 2011 requires a person conducting a business or undertaking to ensure health and safety so far as is reasonably practicable. Section 27 expects officers to verify that safety resources and processes are in place and used. An audit is how you prove it.
Build your internal audit schedule around risk
Start with a full list of IMS processes, sites and legal obligations. Then rate each one for risk and past performance. For example, work at height, plant, hazardous chemicals and contractor management usually need audits every six months. Stable, low risk processes can wait twelve.
Next, make sure every clause and every site is covered at least once in the cycle. Spread the audits across the year instead of stacking them into one big event. A monthly rhythm keeps auditors fresh and keeps findings current.
Mix the audit types as well. System audits test your documents against the standard. Process audits follow the work from start to finish. Site audits verify that critical controls work in the field.
Finally, record a last audit date, a frequency and a next due date for every line. Your internal audit schedule should then flag what is current, due soon or overdue without anyone chasing it.
Choose auditors who are competent and impartial
Nobody should audit their own work. In a small business, this is the hardest rule to meet. However, you can swap auditors between sites or departments, or engage an external auditor for sensitive areas.
Competence matters just as much. Auditors need to know the standard, the relevant legislation and sound audit technique. ISO 19011:2018 sets out these expectations. Train your people, then keep a record of their training and audit experience.
Good auditors follow the evidence. They observe the work, interview workers and sample records. They do not simply tick a checklist.
Turn audit findings into corrective action
A finding without an owner is just an opinion. Grade each finding as a major nonconformity, a minor nonconformity, an observation or an opportunity for improvement. Then assign a responsible position, a root cause and a due date.
Link every nonconformity to your corrective action process under Clause 10.2 of each standard. After the fix, check that it worked. If the same issue returns, the root cause was probably wrong.
Share the results with workers and Health and Safety Representatives. This supports your consultation duties under Part 5 of the WHS Act. Then send the audit results into your management review under Clause 9.3, because leaders need the unfiltered picture.
Practical Application
Consider an Australian manufacturer with 40 staff across two sites. Previously, one consultant audited everything each October. Now the QHSE Manager runs a rolling internal audit schedule of about one audit a month.
In the first quarter, a trained supervisor from Site B audits chemical storage and plant guarding at Site A. In the second quarter, the roles swap. The QHSE Manager audits contractor management and the legal register, because those areas carry high risk. Low risk areas such as document control are audited once a year.
Each audit finishes with a short report within five working days. Findings go into the register with an owner and a due date. The status turns amber 30 days before an audit is due and red when it is overdue. As a result, the Managing Director sees the real position at every management review.
Schools and other education providers can use the same approach to verify child safety, WHS and facilities controls across campuses. Independent schools in particular benefit from a visible, evidence-based audit cycle. See how MiSAFE supports schools.
Conclusion
A risk-based internal audit schedule, impartial auditors and firm follow-up turn audits from an annual scramble into a steady source of improvement. Start with your highest risks, put dates against every line and close every finding.
The MiSAFE All-in-One QHSE subscription can set up your audit programme, checklists and corrective action workflows inside your system. Explore MiSAFE QHSE systems and compliance.
Ready to act? Contact us today or book a free 45-minute consultation. You can also email contact@misafesolutions.com.au or phone 07 5641 2101.
Download the Free Template
Download the free Internal Audit Schedule and Register (.xlsx) and start tracking every audit, finding and due date in one place.
This article is general guidance. Check the legislation that applies in your state, or talk to us about your situation.
