Health and Safety in Supplier Audits | Arinite

A large customer tells you they are running a supplier audit. Procurement forwards the scope, somebody skims the commercial and data protection sections, and the health and safety pillar goes to whoever is nearest.

That pillar is where most non-conformities are raised. Not because suppliers are unsafe, but because the audit asks for evidence rather than intent, and the evidence is scattered across four systems and three people.

This has stopped being a manufacturing concern. Software vendors, legal and advisory firms, insurers and education providers are now audited by their enterprise and public sector customers, and the question set is broadly the same whether the auditor arrives under a recognised ethical audit framework such as the SMETA methodology, a customer's own protocol, or a tender-stage assessment. The underlying expectations trace back to the ETI Base Code and the ILO conventions behind it.

Here are the fifteen things a buyer's auditor will ask to see, in roughly the order they ask.

1. A signed, dated health and safety policy

The first document requested and a surprisingly common early failure. Auditors look for a current statement, signed by someone identifiable at the top of the organisation, with a date that is not several years old. An undated policy or one signed by a departed chief executive reads as a dormant system.

2. The arrangements behind the policy

Separate from the statement itself. Regulation 5 of the Management of Health and Safety at Work Regulations 1999 requires arrangements for the effective planning, organisation, control, monitoring and review of preventive measures. An auditor reads the policy for intent and the arrangements for whether anything actually happens.

3. Named responsibilities

Who holds the duty, who the competent person is, and whether the people named still work there. Section 2 of the Health and Safety at Work etc. Act 1974 sits behind this, and where the function is outsourced the auditor will want to see the competent person arrangement rather than a supplier's logo on a certificate.

4. Current written risk assessments

Not a template library. Assessments for the work actually done, with dates, reviewers and evidence of review after change. The giveaway is a set of documents all created in the same week, which usually means they were produced for a previous audit rather than to manage anything.

5. Accident and incident records

Auditors ask for the raw register, not a summary, and they read its shape. An office population of 200 with no recorded incidents over three years indicates under-reporting rather than exceptional safety, and under-reporting is itself a finding.

6. Evidence of statutory reporting

Where an incident crossed a legal threshold, the auditor wants to see that it was reported. In Great Britain that means regulation 4 of the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, including the over-seven-day incapacity limb, which is the one most often missed because the absence was logged by HR.

7. The fire risk assessment and its evidence trail

Current assessment, review date, and the records that show the arrangements work: alarm tests, drills, emergency lighting checks, and any actions arising with evidence of closure. A good assessment with no supporting records scores poorly, because the audit is about the system rather than the document.

8. Statutory inspection records for plant and equipment

Lifting equipment, electrical installations, pressure systems, gas appliances and any item with a prescribed examination interval. In a leased building the records frequently sit with a landlord or managing agent, and the auditor's question is whether you can produce them, not who holds them.

9. Training records with dates and refresh cycles

Induction for every starter, role-specific training where the risk warrants it, and fire warden and first aid cover proportionate to headcount at every site. The common failure is a cumulative total of people trained since opening, where the auditor wants current coverage and expiry dates.

10. First aid provision tied to an assessment

Not a ratio somebody heard. Provision determined by a needs assessment, with cover that survives leave and out-of-hours working. Auditors increasingly ask how the number was arrived at, and "one per fifty" is not an answer.

11. Worker consultation evidence

The pillar most likely to fail in a non-unionised professional firm, because consultation is a duty rather than an engagement activity. Minutes, a committee or an elected representative route, and evidence that something changed as a result. An intranet page is information, not consultation.

12. Chemical inventory and safety data sheets

Even an office has an inventory: cleaning products, maintenance materials, print room consumables, and in education and technology settings laboratory and workshop substances. The auditor wants the list, the data sheets, the assessments where required and the training for the people handling them.

13. Control of contractors and agency workers

Who inducts them, who assesses their work, who records an incident involving one of them, and whether their licences and insurances are checked. A supplier with 180 employees and 40 contracted staff frequently has one set of records and two populations.

14. Close-out of previous findings

The single strongest signal in the whole audit. Auditors look at the last report and check whether the actions were completed, on time, with evidence. An organisation that closed its previous findings properly is treated differently from one presenting the same gaps a second time.

15. The multi-site and overseas position

Finally, the question that separates a local answer from a group one. If the entity being audited operates in more than one country, the auditor will ask whether each site meets its own national requirements rather than a translated group standard, and whether anybody has verified that.

What a buyer sees, and what trips suppliers

What is asked for	Weak evidence	Evidence that passes
Policy	Undated, or signed by someone who left	Current, signed at the top, dated this cycle
Arrangements	Policy only	Planning, control, monitoring and review described and happening
Responsibilities	A logo on a certificate	Named people, still employed, with a defined competent person route
Risk assessments	Template library, all created in one week	Dated, reviewed after change, matched to the actual work
Incident records	A clean summary	Raw register with a plausible shape
Statutory reporting	Nothing, because HR logged the absence	Reports made, with the threshold reasoning recorded
Fire	Assessment with no records	Assessment plus tests, drills and closed actions
Statutory inspections	"The landlord has it"	Records you can produce on request
Training	Total trained since opening	Current coverage and expiry dates
First aid	A ratio	A needs assessment and resilient cover
Consultation	Intranet page	Minutes, a route, and a change that followed
Chemicals	"We're an office"	Inventory, data sheets, assessments, training
Contractors	One record set for two populations	Induction, assessment and incident records for both
Previous findings	Reopened, unexplained	Closed on time with evidence
Multi-site	One group document	Each site verified against its own national test

Fourteen of those fifteen rows can be fixed in advance for a fraction of the cost of failing one. The exception is row fourteen, which can only be fixed by having acted last time.

Why this is now a commercial question, not a compliance one

Three things have changed, and together they move this from the back of a questionnaire to the front of a renewal.

Buyers have statutory reporting of their own. Section 54 of the Modern Slavery Act 2015 requires qualifying organisations to publish an annual statement on steps taken in their own business and supply chains, and working conditions sit inside that. Your customer's statement is partly assembled from your answers.

Audit outcomes travel. Platforms such as Sedex exist so that one audit can be shared with multiple customers, which cuts duplication and also means a poor result reaches buyers you have not met yet.

And certification is increasingly used as a shortcut. Many protocols accept ISO 45001 certification as evidence against several questions at once, which is why organisations facing repeated customer audits often conclude that certifying is cheaper than answering. Where you are the one bidding, the same material supports health and safety tenders.

The international wrinkle buyers are starting to probe

A group answering as one entity gets caught here, because the auditor's question is increasingly per site rather than per company.

A supplier with a UK head office, an Indian delivery centre and a Polish development team has three regimes and three different documents discharging the risk assessment duty. A translated UK assessment does not satisfy the French or German requirement, local inspection intervals and approved-signatory categories differ, and consultation rights in several countries are materially stronger than the UK's.

Holding that per site, with the local instrument, the interval, the owner and the evidence in one register, is where health and safety consultants and software are worth more in combination than either alone. It is also the difference between an audit you prepare for in a week and one you prepare for in a quarter. Running your own periodic health and safety audits against the fifteen rows above is the cheapest way to find out which answer you do not have, and choosing a provider well matters, which our guide to the top health and safety consultancies covers.

Where Arinite fits

Arinite has spent 15+ years preparing organisations for other people's audits as well as running our own. We support 1,500+ businesses in 50+ countries and protect 100,000+ employees, with 95%+ client retention. Our health and safety consultants work extensively with IT and software, legal and office-based clients, which is where customer-driven audits have grown fastest and where the chemical and contractor rows are most often dismissed as irrelevant.

For groups answering per site, our global health and safety consultants produce the local instrument each country requires, and our international health and safety consultants can tell you which site would fail row fifteen today.

Take the fifteen rows to whoever owns your next customer audit and mark the ones you could evidence this week. Then book a free gap analysis and we will tell you in one call where the audit will land.

The Health and Safety Section of a Customer Audit: 15 Things Buyers Check